Webnalytics — Privacy-Friendly On-site Analytics Security & Risk Analysis

The webnalytics plugin v3.4.26.4 exhibits a generally strong security posture with excellent practices in output escaping and a high percentage of prepared SQL statements. The absence of known CVEs and a clean vulnerability history further bolster confidence in its security. However, the static analysis reveals specific areas of concern that introduce potential risks.

The primary risk stems from the presence of four unprotected AJAX handlers, representing a significant portion of the plugin's attack surface without proper authentication or authorization checks. This could allow unauthenticated users to trigger potentially sensitive actions. Additionally, the taint analysis identified one flow with unsanitized paths, classified as high severity, indicating a potential for more complex vulnerabilities if not addressed.

While the plugin demonstrates strengths in many areas, the unprotected AJAX endpoints and the identified unsanitized path flow are notable weaknesses. The lack of past vulnerabilities is a positive indicator, suggesting developer diligence, but it does not negate the immediate risks identified in the current version's code. A balanced view suggests a plugin with good fundamentals but requiring immediate attention to its exposed AJAX functionality and the high-severity taint flow.