TOURMIX Security & Risk Analysis

The tourmix plugin v1.1.18 exhibits a concerning security posture due to a significant number of unprotected entry points. With 5 total entry points, all 5 (4 AJAX handlers and 1 REST API route) lack authentication and authorization checks. This creates a broad attack surface where unauthenticated users could potentially interact with sensitive plugin functionalities.

While the plugin shows good practices in its use of prepared statements for SQL queries (92%) and proper output escaping (87%), the absence of nonce and capability checks is a major oversight. The static analysis did not reveal any critical or high severity taint flows, and the plugin has no recorded vulnerability history, which are positive indicators. However, the lack of fundamental security checks on its exposed interfaces is a critical weakness that could be exploited if functionalities accessible through these points are sensitive or prone to manipulation.

In conclusion, the plugin has strengths in its data handling (SQL and output escaping) and a clean vulnerability history. Nevertheless, the identified lack of authentication and authorization on all its entry points presents a substantial risk. Addressing these unprotected interfaces should be the highest priority to improve the plugin's overall security.