weForms – Easy Drag & Drop Contact Form Builder For WordPress Security & Risk Analysis

The weForms plugin v1.6.28 exhibits a mixed security posture. While it demonstrates strong practices in areas like prepared SQL statements (97%) and output escaping (91%), and has no currently unpatched CVEs, several concerning findings emerge from the static analysis. The presence of 4 unprotected AJAX handlers significantly increases the attack surface, as these can be exploited by unauthenticated users. The taint analysis reveals 8 high-severity flows with unsanitized paths, indicating potential injection vulnerabilities that could lead to serious compromises. The plugin's history of 9 CVEs, including 2 high-severity ones, suggests a recurring pattern of vulnerabilities, although the absence of recent unpatched issues is positive.

Despite a good foundation in general security practices, the specific risks identified in the static analysis (unprotected entry points and high-severity taint flows) and the historical vulnerability trend warrant careful consideration. The plugin's strengths lie in its commitment to prepared statements and output escaping. However, the identified weaknesses, particularly the unprotected AJAX handlers and the taint analysis results, represent immediate risks that could be exploited. The plugin's past vulnerability patterns, even if currently patched, highlight an area that requires continued vigilance.