Contact Form to Chat Apps | Click to Chat to Order – FormyChat Security & Risk Analysis

The "social-contact-form" plugin v2.15.1 exhibits a mixed security posture. While it demonstrates good practices by avoiding dangerous functions, file operations, and external HTTP requests, and utilizing prepared statements for a majority of its SQL queries, significant concerns arise from its attack surface. A notable number of AJAX handlers (4 out of 5) and REST API routes (2 out of 20) lack proper authentication or permission checks, exposing these entry points to potential unauthorized access and manipulation. Furthermore, the taint analysis reveals two high-severity flows with unsanitized paths, indicating potential vulnerabilities that could lead to data compromise or code execution if exploited. The absence of any recorded CVEs is a positive sign, suggesting a history of stable and secure releases. However, this does not negate the risks identified in the static and taint analysis.