Supafolio Security & Risk Analysis

The Supapress plugin, version 2.27.0, exhibits a mixed security posture. While it has no recorded historical vulnerabilities and no critical issues in taint analysis, significant concerns arise from its attack surface. A large number of AJAX handlers (11 out of 11) lack proper authentication checks, presenting a substantial risk of unauthorized actions. The code analysis also reveals issues with output escaping, with only 18% of outputs being properly escaped, increasing the potential for cross-site scripting (XSS) vulnerabilities. The presence of bundled libraries like Select2 and Guzzle v1.1, while not explicitly flagged as outdated, warrants caution as outdated dependencies can introduce known vulnerabilities. Despite a lack of historical CVEs suggesting a proactive approach to security or a low profile, the current static analysis points to immediate risks that need to be addressed, particularly the unprotected AJAX endpoints and widespread output escaping deficiencies.