text message sms extension for contact form 7 Security & Risk Analysis

The plugin "text-message-sms-extension-for-contact-form-7" v3.1 exhibits a concerning security posture due to significant weaknesses in its attack surface and data handling. The presence of two AJAX handlers lacking authentication checks is a major red flag, directly exposing potential attack vectors. Furthermore, the plugin's reliance on raw SQL queries without prepared statements and a low percentage of properly escaped output indicate a high risk of injection vulnerabilities and cross-site scripting (XSS) attacks. While the plugin has no recorded vulnerability history or taint flow issues, this does not negate the inherent risks identified in the static analysis. The absence of vulnerability history could indicate a lack of public discovery or an incomplete security audit. Overall, the plugin presents several critical areas for immediate remediation, specifically concerning the unprotected AJAX endpoints and insecure data handling practices, despite a seemingly clean historical record.