VikAppointments Services Booking Calendar Security & Risk Analysis

The VikAppointments plugin v1.2.18 exhibits a mixed security posture. While it demonstrates good practices in SQL query handling by exclusively using prepared statements, several critical vulnerabilities are present. The static analysis reveals a significant attack surface with two AJAX handlers lacking authentication checks, which can be exploited by unauthenticated users. Furthermore, the presence of the `unserialize` function without proper sanitization is a serious concern, potentially leading to Remote Code Execution if untrusted data is passed to it. The plugin also shows a concerning lack of nonces and capability checks on its entry points, increasing its susceptibility to various attacks.

The vulnerability history, while showing no currently unpatched CVEs, does indicate a past medium-severity vulnerability related to Cross-Site Request Forgery (CSRF). This suggests a pattern of past security oversights. The high percentage of improperly escaped output further exacerbates the risks, potentially leading to Cross-Site Scripting (XSS) vulnerabilities. The inclusion of an outdated library (Select2 v3.5.1) also presents a potential attack vector.

In conclusion, while the plugin has strengths in its SQL handling, the identified security weaknesses, particularly the unprotected AJAX handlers, the use of `unserialize`, and the absence of proper authorization and input validation, make it a moderate to high-risk plugin. Immediate attention is required to address these vulnerabilities to prevent potential exploitation.