Slovenská pošta – ePodací hárok Security & Risk Analysis

The "slovenska-posta-epodaci-harok" v1.4.6 plugin exhibits several concerning security practices despite having no recorded vulnerability history. The static analysis reveals a significant attack surface with 4 AJAX handlers, all of which lack authentication checks. This means any user, potentially even unauthenticated ones, could trigger these handlers, leading to unauthorized actions or information disclosure. Furthermore, the presence of the `unserialize` function, a known vector for object injection vulnerabilities, is a critical concern, especially when coupled with unescaped output in 36% of its outputs and 4 identified taint flows with unsanitized paths. While the plugin uses prepared statements for SQL queries, which is a positive, the other identified risks outweigh this benefit. The absence of any known CVEs is a positive indicator, but it does not negate the inherent risks identified in the current codebase. A proactive approach to securing the AJAX endpoints and properly sanitizing or validating data before unserialization is crucial.