WP Group Menu Security & Risk Analysis

The wp-group-menu v1.0 plugin presents a significant security risk due to its handling of AJAX requests. A single AJAX handler lacks authentication checks, creating a direct entry point for unauthenticated users. Furthermore, the taint analysis reveals a concerning number of flows with unsanitized paths, with four classified as high severity. This indicates a strong potential for vulnerabilities like Cross-Site Scripting (XSS) or even Remote Code Execution (RCE) if these unsanitized paths can be exploited. The plugin also exhibits poor output escaping practices, with only 14% of outputs being properly escaped, increasing the likelihood of XSS attacks.

While the plugin has no recorded CVEs, this should not be interpreted as a guarantee of safety, especially given the identified code analysis issues. The absence of past vulnerabilities might simply mean the plugin hasn't been extensively targeted or that previous issues were not publicly disclosed. The limited capability checks and lack of nonce checks on the unprotected AJAX handler are also significant weaknesses. Overall, the plugin's current state is concerning, with critical areas for improvement in input validation, output sanitization, and access control, particularly for its AJAX endpoints.