teachPress Security & Risk Analysis

The TeachPress plugin v9.0.12 exhibits a mixed security posture, with some positive indicators but significant areas of concern. While it utilizes prepared statements for a good portion of its SQL queries and has a decent number of nonce and capability checks, the presence of unprotected AJAX handlers and a notable percentage of improperly escaped output are red flags. The taint analysis results are promising, showing no critical or high severity unsanitized flows, but this is juxtaposed by the plugin's historical vulnerability record. The nine known CVEs, including a high-severity SQL injection and several medium-severity issues like CSRF and XSS, suggest a recurring pattern of insecure coding practices. The fact that two CVEs remain unpatched is a critical issue, compounding the risks associated with the existing vulnerabilities. The plugin's last vulnerability was recorded very recently, indicating ongoing security challenges.