Sheetable – Google Sheets to WP Table Security & Risk Analysis

The plugin "sheetable-datatable-from-google-sheet" version 1.0.2 exhibits a generally good security posture, with several positive indicators. The code demonstrates a strong adherence to secure coding practices by using prepared statements for nearly all SQL queries and ensuring 100% proper output escaping. The absence of dangerous functions, file operations, and external HTTP requests further strengthens its security. The vulnerability history is also clean, with no recorded CVEs, suggesting a well-maintained and secure codebase over time.

However, there are notable concerns that detract from an otherwise positive assessment. The presence of one REST API route without permission callbacks represents a significant attack vector. Furthermore, the static analysis found one flow with unsanitized paths, which, although not classified as critical or high severity in the taint analysis, still warrants attention as it indicates potential for insecure data handling. The complete lack of nonce checks across all entry points is another significant weakness, especially given the presence of unprotected REST API routes.

In conclusion, while the plugin demonstrates strengths in data handling and SQL security, the unprotected REST API route and the absence of nonce checks are substantial security weaknesses. The clean vulnerability history is a positive sign, but it does not negate the immediate risks identified in the static and taint analysis. Addressing the unprotected entry point and implementing nonce checks on all handlers would significantly improve the plugin's security.