Lemme Know Security & Risk Analysis

The 'wp-lemme-know' plugin v0.11.0 exhibits a concerning security posture due to a significant number of unprotected AJAX entry points. While the plugin demonstrates good practices by using prepared statements for all SQL queries and has no recorded vulnerability history, the lack of authentication checks on its AJAX handlers presents a substantial attack surface. The taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for malicious data to be processed without proper validation, which could lead to security issues if these paths are exploitable. Although the plugin avoids dangerous functions and external HTTP requests, the presence of unprotected AJAX handlers and high-severity taint flows are critical weaknesses that overshadow its strengths. The absence of nonce and capability checks on these entry points makes them prime targets for various attacks. Overall, while the plugin's SQL handling is secure, the unprotected AJAX handlers and high-severity taint flows require immediate attention to mitigate significant risks.