Referral Link Tracker Security & Risk Analysis

The referral-link-tracker plugin exhibits a mixed security posture. On the positive side, it demonstrates excellent output escaping practices, with 100% of outputs properly escaped, and it does not engage in file operations or external HTTP requests. The absence of critical or high-severity taint flows and dangerous functions is also a good sign. However, significant concerns arise from its attack surface. With 8 AJAX handlers, 3 of which lack any authentication checks, this presents a direct avenue for unauthenticated attackers to interact with the plugin's functionality. Furthermore, the plugin has a history of a known medium-severity vulnerability, specifically related to missing authorization, and one such vulnerability remains unpatched. This pattern of missing authorization, coupled with the current lack of capability checks and the presence of unprotected AJAX endpoints, suggests a recurring weakness that needs immediate attention.