VikBooking Hotel Booking Engine & PMS Security & Risk Analysis

The static analysis of Vikbooking v1.8.7 reveals several significant security concerns that contribute to a moderately high risk profile. The presence of two AJAX handlers without authentication checks presents a direct and easily exploitable attack vector. While the total number of entry points is low, the unprotected ones are particularly concerning. The significant number of file operations (151) coupled with a very low percentage of properly escaped output (6%) strongly suggests a high likelihood of Cross-Site Scripting (XSS) vulnerabilities. The extensive use of `unserialize` (5 instances) is a known risk, especially if the serialized data can be influenced by user input, potentially leading to code execution. The lack of nonce checks and capability checks on any entry points further exacerbates these risks, allowing unauthorized actions. The plugin's vulnerability history is a major red flag, with 17 known CVEs, including a past critical vulnerability and several high-severity ones. The common types of past vulnerabilities, such as Missing Authorization and XSS, align with the weaknesses identified in the static analysis, indicating a pattern of recurring security flaws. The plugin does exhibit some good practices, such as a high percentage of SQL queries using prepared statements and the inclusion of common bundled libraries, but these are overshadowed by the critical lack of fundamental security checks and the plugin's history of severe vulnerabilities. Overall, this version of Vikbooking should be treated with extreme caution and is not recommended for use without immediate patching and further security audits.