Trustpilot Reviews Security & Risk Analysis

The trustpilot-reviews plugin v3.11.0 exhibits a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a high percentage of properly escaped output, there are significant concerns regarding its attack surface and historical vulnerability patterns. The presence of three AJAX handlers without authentication checks is a notable risk, as these could potentially be exploited by unauthenticated users to perform unintended actions or expose sensitive information.

Taint analysis revealed one flow with unsanitized paths, which, although not classified as critical or high severity in this report, warrants attention as it indicates a potential pathway for injection vulnerabilities if not properly handled. The plugin's history includes one medium-severity CVE, and while currently unpatched vulnerabilities are zero, the common vulnerability type being 'Missing Authorization' is a red flag. This suggests a recurring issue with securing entry points, which aligns with the static analysis finding of unprotected AJAX handlers.

In conclusion, the plugin has strengths in its data handling and output sanitization. However, the unprotected AJAX endpoints and past authorization issues present clear security weaknesses that require immediate remediation. Addressing the unprotected entry points and ensuring robust authorization checks are implemented across all handlers would significantly improve the plugin's overall security posture.