Sotmarket Affiliate plugin Security & Risk Analysis

The "sotmarket-affiliate-plugin" version 3.0.9 exhibits a concerning security posture despite a lack of publicly disclosed vulnerabilities. The static analysis reveals significant red flags, particularly in how the plugin handles data and performs operations. A large number of dangerous functions are present, including `unserialize`, `assert`, and `create_function`. Furthermore, the plugin exclusively uses raw SQL queries without prepared statements, which is a common vector for SQL injection vulnerabilities. The complete absence of proper output escaping across all identified output points is extremely worrying, suggesting a high likelihood of cross-site scripting (XSS) flaws. The taint analysis also highlights critical severity flows with unsanitized paths, indicating potential for severe data manipulation or execution vulnerabilities. While the plugin has no recorded CVEs, this absence of historical vulnerabilities does not equate to a secure codebase, especially given the extensive code-level risks identified. The plugin demonstrates some good practices with nonce and capability checks, but these are overshadowed by the critical flaws in data handling and output sanitization. The overall risk is high, and immediate attention to code quality is recommended.