WP Adf.ly Dashboard and Integration Security & Risk Analysis

The "wp-adf-ly-dashboard-and-integration" plugin version 1.3.7 exhibits a concerning security posture, primarily due to its unprotected AJAX endpoint. While the plugin avoids common pitfalls like dangerous functions and raw SQL queries, the presence of an AJAX handler without any authentication or capability checks represents a significant attack vector. The taint analysis revealing two flows with unsanitized paths, even without critical severity, suggests potential for data manipulation or execution if an attacker can trigger these flows. The absence of any recorded vulnerabilities in its history could indicate a lack of rigorous security testing or a very new plugin. However, this should not be taken as a guarantee of future security. The combination of an unprotected entry point and potentially unsanitized data flows presents a notable risk.