WP Mautic Form Integrator Security & Risk Analysis

The wp-mautic-form-integrator plugin exhibits a concerning security posture primarily due to its unprotected entry points. With 3 AJAX handlers and none of them incorporating authentication checks, a significant portion of the plugin's attack surface is exposed to unauthenticated users. This lack of authorization checks on AJAX actions is a critical weakness that could allow unauthorized users to trigger potentially sensitive operations. The taint analysis further highlights this concern, revealing two high-severity flows with unsanitized paths, indicating potential for malicious data injection or manipulation through these exposed entry points. While the plugin uses prepared statements for a majority of its SQL queries and has a decent rate of output escaping, these strengths are overshadowed by the fundamental lack of access control on its AJAX endpoints. The absence of any recorded vulnerabilities in its history is a positive sign, suggesting good development practices in the past or a lack of past targeted attacks. However, the current findings present an immediate and pressing risk that needs to be addressed.