WP-HR GDPR: GDPR Tools for Human Resources on WordPress Security & Risk Analysis

The wp-hr-gdpr plugin version 0.9 exhibits a mixed security posture. While it demonstrates some good practices, such as a high percentage of SQL queries using prepared statements and a clean vulnerability history with no known CVEs, there are significant areas of concern. The plugin has a notable attack surface, with four out of six AJAX handlers lacking authentication checks. Furthermore, the taint analysis reveals one high-severity flow with unsanitized paths, indicating a potential for exploitation if data is processed without proper validation. The presence of the `unserialize` function, often a vector for deserialization vulnerabilities, is another red flag. Despite the absence of historical vulnerabilities, the current code analysis points to potential weaknesses that require immediate attention, particularly the unprotected AJAX endpoints and the identified high-severity taint flow. The plugin's strengths lie in its SQL query practices and lack of historical issues, but the identified code-level risks overshadow these positives, suggesting a moderate to high risk level without remediation.