Ever Accounting – Accounting & Invoicing Solution for Small Businesses Security & Risk Analysis

The wp-ever-accounting v2.2.8 plugin exhibits a generally good security posture with several strengths. The absence of unprotected entry points across AJAX handlers, REST API routes, shortcodes, and cron events is a significant positive. The code also demonstrates robust practices with a high percentage of properly escaped outputs and a substantial number of capability checks. The use of prepared statements for a majority of SQL queries further indicates a commitment to secure database interactions.

However, some areas warrant attention. The presence of four flows with unsanitized paths, even if not flagged as critical or high severity in the taint analysis, represents a potential risk. These could be pathways for malicious input to reach sensitive functions. While the plugin has a history of only one medium-severity vulnerability, which is currently patched, the fact that a CSRF vulnerability was previously present suggests a need for continued vigilance in input validation and state-changing operation protection. The bundled Select2 library, while not explicitly stated as outdated, could be a vector if it contains known vulnerabilities.

In conclusion, wp-ever-accounting v2.2.8 appears to be a reasonably secure plugin with strong foundational security practices. The low number of vulnerabilities and the focus on prepared statements and output escaping are commendable. The primary areas for improvement lie in thoroughly sanitizing all identified unsanitized paths and ensuring any bundled libraries are kept up-to-date to mitigate potential risks.