Unnotifier — disable admin notices individually Security & Risk Analysis

The 'unnotifier' plugin version 1.2.7 exhibits a mixed security posture. On the positive side, it demonstrates strong security practices by utilizing prepared statements for all SQL queries, a high percentage of output escaping, and a significant number of nonce and capability checks. Furthermore, the absence of any known historical CVEs and no recorded critical or high severity vulnerabilities suggest a generally stable and well-maintained codebase. The taint analysis also reports no critical or high severity issues, indicating a lack of obvious severe code injection or data manipulation vulnerabilities.

However, there are significant concerns regarding the plugin's attack surface. Specifically, the presence of four AJAX handlers, with three of them lacking proper authentication checks, presents a considerable risk. This means that potentially sensitive actions or data processing could be triggered by unauthenticated users, opening the door for unauthorized operations. While the static analysis doesn't reveal explicit dangerous functions or unsanitized paths, the unprotected AJAX endpoints are a prime target for attackers. The plugin's strengths in secure coding practices are undermined by this glaring weakness in access control for its AJAX endpoints.