Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more Security & Risk Analysis

This plugin exhibits a mixed security posture. While it demonstrates strong practices in SQL query handling and output escaping, significant vulnerabilities lie in its attack surface and lack of authorization checks. The static analysis reveals a substantial number of unprotected AJAX handlers and REST API routes, presenting a broad avenue for potential exploits. The taint analysis further highlights a high-severity flow with unsanitized paths, indicating a direct risk of vulnerabilities like cross-site scripting or directory traversal if exploited. The plugin's history of known CVEs, particularly those involving missing authorization, CSRF, and XSS, strongly correlates with the current findings, suggesting recurring security weaknesses that have not been fully addressed.

Despite the strengths in secure coding for SQL and output, the sheer number of unprotected entry points and the identified taint flow are major concerns. The historical pattern of medium-severity vulnerabilities like Missing Authorization, CSRF, and XSS, even though currently unpatched, points to an ongoing struggle with securing user input and controlling access. This plugin should be treated with caution, and immediate attention should be paid to implementing proper authorization checks and sanitizing all user-supplied data, especially within the identified unprotected AJAX and REST API endpoints.