Subscribe to Download Lite – Email Before Download Plugin Security & Risk Analysis

The "subscribe-to-download-lite" v1.3.0 plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query handling (80% prepared statements) and output escaping (83% proper), significant concerns arise from its attack surface and taint analysis. A substantial portion of its AJAX handlers (6 out of 6) lack authentication checks, creating a wide entry point for potential unauthorized actions. Furthermore, the taint analysis revealed one high-severity flow with unsanitized paths, indicating a risk of file inclusion vulnerabilities if user-controlled input is not properly validated before being used in file operations. The vulnerability history, though currently showing no unpatched CVEs, has a past of two high-severity "Improper Control of Filename for Include/Require Statement" vulnerabilities. This pattern suggests a recurring weakness in handling file-related operations, which, when combined with the static analysis findings, amplifies the risk.