Tournamatch Security & Risk Analysis

The Tournamatch plugin v4.7.0 exhibits a mixed security posture. While it demonstrates good practices in several areas, such as a high percentage of prepared SQL statements and properly escaped output, significant concerns remain. The presence of two AJAX handlers without authentication checks is a notable weakness, directly contributing to a less secure attack surface. The taint analysis revealing six high-severity flows with unsanitized paths is particularly worrying, as these represent potential avenues for attackers to inject malicious code or data. The plugin's vulnerability history, with four known CVEs and one still unpatched, further amplifies these concerns. The prevalence of Cross-Site Scripting (XSS) vulnerabilities in the past suggests a recurring issue with input sanitization or output encoding, which aligns with the high-severity taint flows identified.