WordPoints Security & Risk Analysis

The WordPoints plugin v2.4.2 exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to secure coding practices, with a high percentage of SQL queries using prepared statements and a very high rate of output escaping. The absence of known CVEs and a history of vulnerabilities is also a significant strength, indicating a generally well-maintained and secure codebase over time.

However, a major concern arises from the extensive attack surface presented by its AJAX handlers. All 11 AJAX handlers lack authentication checks, meaning any unauthenticated user can potentially trigger these functionalities. While taint analysis did not reveal critical or high severity vulnerabilities, the presence of 6 flows with unsanitized paths is a notable weakness that could be exploited if an attacker can control the input to these paths. Furthermore, the plugin has 18 nonce checks, but it's unclear from the data if these are adequately implemented across all AJAX handlers, especially given the lack of authentication checks.

In conclusion, while WordPoints has a good track record and strong internal code hygiene, the lack of authentication on its AJAX endpoints presents a significant, exploitable risk. This oversight, coupled with the identified unsanitized paths in taint analysis, significantly outweighs the positive aspects of its security practices. The plugin's developers should prioritize implementing proper authentication and authorization checks on all AJAX handlers to mitigate this risk.