Rezgo Online Booking Security & Risk Analysis

The "rezgo" v4.22 plugin exhibits a mixed security posture, with some positive security practices alongside significant areas of concern. While the plugin demonstrates a high rate of output escaping (92%) and a reasonable number of nonce checks, the presence of unprotected AJAX handlers and a lack of preparedness for SQL queries are notable weaknesses. The static analysis reveals critical risks related to unsanitized paths in taint flows, indicating potential for attackers to manipulate file operations or inject malicious code. The 4 identified dangerous functions, specifically "unserialize," further amplify these risks, as unserialized data from untrusted sources can lead to arbitrary code execution.

The plugin's vulnerability history shows a pattern of past security flaws, particularly concerning Remote File Inclusion and Cross-site Scripting. Although there are currently no unpatched CVEs, the existence of a high-severity unpatched vulnerability in the past, along with past medium-severity issues, suggests a recurring need for diligent security patching and code review. The fact that the last vulnerability was in 2025-01-06, despite it being a past vulnerability, is a curious detail but doesn't negate the historical pattern. Overall, the plugin has strengths in output handling but requires immediate attention to its insecure entry points, data sanitization, and historical vulnerability trends.