FormsDB – Save Elementor Forms to Google Sheets & Post Type Security & Risk Analysis

The sb-elementor-contact-form-db plugin v2.1.7 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and a high percentage of properly escaped output. The absence of dangerous functions and file operations further contributes to its security. However, the presence of one AJAX handler without authentication checks presents a significant concern, potentially allowing unauthorized users to interact with plugin functionalities.

The vulnerability history reveals a concerning pattern, with three known CVEs, including one high-severity vulnerability. The types of past vulnerabilities, such as Cross-Site Scripting and Exposure of Sensitive Information, suggest potential weaknesses in input validation and output encoding that, despite current improvements, might indicate underlying architectural issues. The fact that none of the past vulnerabilities are currently unpatched is a positive sign, implying the developers have addressed previous issues.

Overall, while the plugin has made strides in security, the unauthenticated AJAX endpoint and the historical prevalence of critical vulnerability types warrant careful consideration. The attack surface is relatively small, but the unprotected entry point is a weakness that could be exploited. Continued vigilance and thorough testing of new versions are recommended.