Age Verification & Identity Verification by Token of Trust Security & Risk Analysis

The 'token-of-trust' plugin v3.32.2 exhibits a concerning security posture due to a significant number of unprotected entry points. While the plugin has no recorded vulnerability history, indicating a potentially low historical risk, the static analysis reveals several areas that warrant attention. Specifically, 6 out of 8 AJAX handlers and 1 out of 1 REST API route lack authentication checks, creating a substantial attack surface accessible to unauthenticated users. Furthermore, the taint analysis shows 6 flows with unsanitized paths, a critical indicator of potential vulnerabilities, even though they are not classified as critical or high severity in this specific scan. The moderate percentage of proper output escaping and the usage of prepared statements for SQL queries are positive signs, but the unescaped output and raw SQL queries still present a risk. The presence of bundled libraries like Guzzle and Select2 is standard, but their security depends on their individual patch status, which is not detailed here. Overall, the plugin's strengths lie in its lack of historical vulnerabilities and some good coding practices like prepared statements. However, the numerous unprotected entry points and unsanitized code paths are significant weaknesses that could be exploited.