SORTD Security & Risk Analysis

The "sortd" v3.0.7 plugin exhibits a concerning security posture, primarily due to an extremely large and unprotected attack surface. With 91 AJAX handlers, all of which lack authentication checks, there is a significant risk of unauthorized actions being performed by unauthenticated users. While the static analysis indicates good practices in other areas, such as 100% of SQL queries using prepared statements and 91% of outputs being properly escaped, these strengths are overshadowed by the critical flaw in its AJAX endpoint security. The taint analysis also identified 3 flows with unsanitized paths, though they are not categorized as critical or high severity, these still warrant investigation as they represent potential avenues for injection vulnerabilities.

The plugin's vulnerability history is notably clean, with no recorded CVEs. This absence of past vulnerabilities could suggest either rigorous past security practices or simply a lack of successful past exploitation attempts. However, given the significant number of unprotected entry points, this clean history should not be seen as a guarantee of current security. The plugin does utilize 111 nonce checks, but these are clearly not being enforced on the vast majority of its AJAX handlers.

In conclusion, while "sortd" v3.0.7 demonstrates strengths in SQL querying and output escaping, its security is severely compromised by the overwhelming presence of unprotected AJAX endpoints. This massive attack surface without proper authorization checks presents a critical risk to any WordPress site using it. The presence of unsanitized paths in the taint analysis further amplifies these concerns, demanding immediate attention to secure these entry points.