WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Security & Risk Analysis

The wp-data-access plugin v5.5.69 presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of prepared SQL statements and a substantial number of nonce and capability checks, significant concerns remain. The analysis reveals a large attack surface with 21 unprotected AJAX handlers, which is a primary point of vulnerability. Furthermore, the taint analysis indicates 16 flows with unsanitized paths, including 3 identified as high severity, suggesting potential for various attacks if these flows are reachable and exploitable through the unprotected entry points.

The plugin's vulnerability history is a notable weakness. It has a total of 6 known CVEs, with 3 high and 3 medium severity vulnerabilities remaining unpatched. The common types of past vulnerabilities, including XSS, CSRF, Incorrect Privilege Assignment, and SQL Injection, directly correlate with the risks identified in the static and taint analysis. This historical pattern strongly suggests recurring issues with input validation and permission handling. Despite strengths in prepared SQL and output escaping, the numerous unprotected AJAX endpoints and the history of severe vulnerabilities necessitate a cautious approach.