Watu Quiz Security & Risk Analysis

The "watu" plugin v3.4.6 presents a mixed security posture. While it demonstrates good practices in SQL query handling and includes a substantial number of nonce and capability checks, several concerning aspects warrant attention. The static analysis reveals a significant attack surface, with 5 out of 11 entry points lacking authentication checks. This is further compounded by the presence of four 'unserialize' calls, a known dangerous function, and taint analysis indicating two high-severity flows with unsanitized paths. The plugin's vulnerability history is also a significant concern, with 17 known CVEs, including 4 high-severity ones, and common vulnerability types such as missing authorization and cross-site scripting. The fact that the last reported vulnerability was in late 2025 (though this seems like a typo and likely refers to a past date) might suggest recent updates, but the historical pattern of multiple vulnerabilities, particularly those related to authorization and input sanitization, points to a recurring need for stringent security development and auditing processes.