SCD – Smart Currency Detector – Premium Variant for WCFM Security & Risk Analysis

The plugin exhibits a mixed security posture. While it demonstrates good practices like a significant number of capability checks and a clean vulnerability history, there are notable areas of concern stemming from its attack surface and data handling. The high number of AJAX handlers (9) without authentication checks presents a significant risk, as these could be leveraged by unauthenticated users. Furthermore, the taint analysis reveals 8 flows with unsanitized paths, 6 of which are considered high severity. This indicates potential vulnerabilities where user-supplied data could be manipulated to execute unintended actions or access sensitive information, especially in conjunction with the unprotected AJAX endpoints. The fact that 48% of SQL queries are not using prepared statements and only 48% of output is properly escaped further exacerbates these risks, suggesting potential for SQL injection and cross-site scripting (XSS) vulnerabilities. The absence of any recorded CVEs is positive, but it does not negate the inherent risks identified in the static and taint analysis. The plugin has strengths in its capability checks and lack of historical vulnerabilities, but the current code analysis reveals critical weaknesses in input validation and access control for its AJAX endpoints.