Realty Portal – Compare Security & Risk Analysis

The 'realty-portal-compare' plugin version 0.3.9 exhibits a concerning security posture primarily due to a significant number of unprotected AJAX endpoints. With 4 out of 4 identified AJAX handlers lacking authentication checks, this presents a wide attack surface for unauthorized actions. While the plugin shows strengths in its avoidance of dangerous functions, reliance on prepared statements for SQL queries, and a clean vulnerability history with no recorded CVEs, these positive aspects are heavily overshadowed by the critical lack of authorization on its entry points. The absence of nonce and capability checks on these AJAX handlers means that any authenticated user, regardless of their role or permissions, could potentially trigger these actions, leading to unintended consequences or even exploitation if the AJAX handlers perform sensitive operations.