Virtual Candles – Memorial Light Display Security & Risk Analysis

The virtual-candles v2.0.3 plugin exhibits a mixed security posture. On the positive side, it demonstrates excellent practices in handling SQL queries with 100% prepared statements and a very high rate of output escaping (97%). Furthermore, there is no historical record of vulnerabilities, suggesting a generally stable and well-maintained codebase. The absence of file operations, external HTTP requests, and bundled libraries are also favorable security indicators.

However, a significant concern arises from the attack surface. The plugin exposes 6 AJAX handlers that lack authentication checks, presenting a potential entry point for unauthenticated attackers. While only one capability check is present, and there are 6 nonces, the direct exposure of AJAX actions without proper authorization is a notable weakness. The taint analysis found no issues, which is reassuring, but the identified unprotected AJAX handlers still pose a real risk.

In conclusion, while the plugin has strong internal code hygiene regarding data handling and output, the unprotected AJAX endpoints create a clear security vulnerability. The lack of historical vulnerabilities is a positive sign, but it does not negate the immediate risk posed by the exposed AJAX functionality. Addressing these unprotected AJAX handlers should be the top priority.