WM Simple Captcha Security & Risk Analysis

The wm-simple-captcha plugin exhibits several concerning security practices that significantly increase its risk profile, despite a lack of recorded past vulnerabilities. The most critical issue is the presence of two AJAX handlers that lack any authentication checks. This exposes the plugin to potential unauthorized access and manipulation, as any user, including unauthenticated ones, could trigger these actions. Furthermore, the plugin's SQL queries are not using prepared statements, which leaves it vulnerable to SQL injection attacks. While the static analysis did not reveal any taint flows, the combination of unprotected entry points and raw SQL queries is a substantial risk. The plugin also shows poor output escaping practices, with only 7% of outputs being properly escaped, potentially leading to cross-site scripting (XSS) vulnerabilities. The absence of any recorded vulnerabilities in its history is not a strong indicator of security, given the identified weaknesses in the codebase. Overall, the plugin's current state presents a high risk due to critical flaws in authentication and data sanitization, outweighing the lack of historical issues.