WP Security By Made I.T. Security & Risk Analysis

The 'wp-security-by-made-it' plugin v1.8.3 presents a mixed security posture. While it boasts a clean vulnerability history with no known CVEs, indicating a good track record of security maintenance or limited exposure, the static analysis reveals significant concerns. A substantial attack surface is exposed, with all 8 identified AJAX handlers lacking authentication checks. This means any authenticated user could potentially trigger these handlers, leading to unintended actions.

The taint analysis further highlights critical security risks. The presence of one critical severity flow with an unsanitized path suggests that user-supplied input could be used to influence sensitive operations, potentially leading to code execution or data manipulation. Additionally, the static analysis flags the use of dangerous functions like 'exec' and 'shell_exec', which, combined with unsanitized input, pose a severe risk of remote code execution.

Despite the clean CVE history, the identified vulnerabilities in the static analysis are serious enough to warrant caution. The lack of capability checks on AJAX handlers is a major oversight. While the use of prepared statements for SQL queries is positive, the presence of critical taint flows and dangerous function usage overrides this strength. This plugin should be treated with a high degree of suspicion until these critical issues are addressed.