Wikipedia Widget Security & Risk Analysis

The "wikipedia-widget" plugin v0.13.12 exhibits a concerning security posture primarily due to its unprotected entry points. While the plugin demonstrates good practices by exclusively using prepared statements for SQL queries and avoiding file operations and bundled libraries, the presence of two AJAX handlers without any authentication or capability checks creates a significant attack surface. This means any authenticated user, regardless of their role or permissions, could potentially trigger these handlers, leading to unintended actions or information disclosure.

The static analysis also flags the use of the "create_function" dangerous function, which is a known security risk due to its ability to execute arbitrary code. While taint analysis found no specific unsanitized paths, the absence of proper output escaping for a substantial portion of the plugin's output (83%) is a clear vulnerability. This could lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are injected into the user's browser.

Adding to the concerns, the plugin lacks nonce checks on its AJAX handlers, further exacerbating the risk of unauthorized actions. The complete absence of recorded vulnerabilities in its history might suggest it hasn't been extensively targeted or audited, but this should not be mistaken for inherent security. The combination of unprotected AJAX handlers, the dangerous "create_function", and insufficient output escaping presents a high risk, outweighing the positive aspects of its SQL handling.