Subscribe2 – Form, Email Subscribers & Newsletters Security & Risk Analysis

The Subscribe2 plugin version 10.45 presents a mixed security posture. While it demonstrates some good practices like a high percentage of prepared SQL statements and a reasonable number of capability checks, there are significant areas of concern.

The static analysis reveals a notable attack surface, with two out of three AJAX handlers lacking authentication checks. This is a critical oversight that could allow unauthorized actions. Furthermore, the taint analysis indicates two flows with unsanitized paths, classified as high severity. These issues, combined with the history of eight known CVEs, including three high-severity vulnerabilities related to missing authorization, CSRF, and XSS, suggest a plugin that has historically been a target and has had recurring security weaknesses.

Despite the absence of currently unpatched CVEs and a recent vulnerability date (though unusually in the future), the combination of unprotected entry points and high-severity taint flows points to a continued need for vigilance. While the plugin has strengths in its SQL handling and nonce checks, the identified weaknesses in authorization and input sanitization, coupled with its vulnerability history, warrant a cautious approach to its deployment.