Send Users Email – Email Subscribers, Email Marketing Newsletter Security & Risk Analysis

The 'send-users-email' plugin exhibits a concerning security posture despite some positive aspects. While the use of prepared statements for SQL queries and a high percentage of properly escaped output are commendable, the plugin suffers from a significant number of unprotected entry points. All six identified AJAX handlers lack authentication checks, creating a substantial attack surface where unauthenticated users could potentially trigger unintended actions. Furthermore, the taint analysis revealed four flows with unsanitized paths, indicating a risk of improper handling of user-supplied data, although no critical or high severity issues were found in this analysis.

The plugin's vulnerability history, with two known medium severity CVEs related to 'Insertion of Sensitive Information into Log File,' is a significant concern. Although currently unpatched vulnerabilities are zero, this pattern suggests a recurring weakness in how sensitive data is handled or logged. The presence of bundled libraries like DataTables and Freemius v1.0, without information on their versions, could also introduce risks if they are outdated or contain known vulnerabilities. Overall, while the plugin demonstrates good practices in database interaction and output sanitization, the lack of authentication on AJAX endpoints and the historical pattern of sensitive information disclosure present clear and actionable security risks that need to be addressed.