SendPress Newsletters Security & Risk Analysis

The SendPress plugin version 1.26.1.20 exhibits a concerning security posture due to a significant number of unprotected AJAX handlers and a history of numerous vulnerabilities, including high and medium severity issues. While the plugin utilizes prepared statements for a majority of its SQL queries and has a substantial number of output escaping operations, the sheer volume of entry points lacking authentication checks presents a substantial attack surface. The presence of the `unserialize` function, even without apparent taint flow issues in this static analysis, warrants caution as it can be a vector for deserialization vulnerabilities if not handled with extreme care. The vulnerability history reveals recurring patterns of Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Missing Authorization, and SQL Injection, indicating a persistent struggle with secure coding practices. The fact that three CVEs remain unpatched is a critical red flag. While the plugin shows some good practices like prepared statements and a large number of output escapes, the unprotected AJAX handlers and the unpatched vulnerabilities significantly outweigh these strengths, leading to a high-risk assessment.