Termin-Kalender Security & Risk Analysis

The plugin "termin-kalender" v1.2.5.2 exhibits a mixed security posture. On the positive side, all identified entry points, including AJAX handlers, REST API routes, and shortcodes, have authorization checks in place. The taint analysis did not reveal any critical or high-severity issues with unsanitized paths. Furthermore, there are no unpatched vulnerabilities currently known, and the last reported vulnerability was of medium severity.

However, several significant concerns are present. The plugin uses SQL queries extensively (11 total) without employing prepared statements, which poses a high risk of SQL injection vulnerabilities. While the number of AJAX handlers and REST API routes is not excessively large, the fact that none of them are protected by nonce checks on the AJAX side (implied by 9 nonce checks for 10 handlers) is a notable weakness. Although external HTTP requests are limited, and file operations are absent, the lack of prepared statements for all SQL queries is the most critical area of concern, potentially outweighing the strengths in other areas.