WB Product Enquiry Security & Risk Analysis

The wb-product-enquiry plugin v1.25 exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and avoiding external HTTP requests, which are common vectors for vulnerabilities. The absence of known CVEs also suggests a history of reasonable security management. However, significant concerns arise from the static analysis. The plugin has a small but entirely unprotected attack surface, with two AJAX handlers lacking any authentication checks. This immediately exposes the plugin to potential unauthorized actions. Furthermore, taint analysis reveals two flows with unsanitized paths, indicating a risk of data injection or manipulation if these paths are reached with untrusted input. The lack of nonces and capability checks on the AJAX endpoints exacerbates these risks.