Toplytics Security & Risk Analysis

The Toplytics plugin version 4.1.2 exhibits a mixed security posture. On the positive side, there are no recorded vulnerabilities (CVEs) in its history, which suggests a general commitment to security or a lack of targeted exploitation. The absence of dangerous functions and external HTTP requests is also reassuring. However, several concerning signals emerge from the static analysis. The presence of a REST API route without a permission callback represents a direct, unprotected entry point into the plugin's functionality. Furthermore, the plugin's handling of SQL queries is a significant weakness, with all queries being executed without prepared statements, opening the door to SQL injection vulnerabilities. The low percentage of properly escaped output is another critical concern, increasing the risk of cross-site scripting (XSS) attacks. While taint analysis did not reveal critical or high severity flows, the presence of unsanitized paths warrants attention, especially in conjunction with the output escaping issues. The plugin has a moderate attack surface with one unprotected entry point. The lack of historical vulnerabilities is positive, but the current static analysis reveals several common and potentially severe security flaws that need immediate remediation.