WP Signals Security & Risk Analysis

The "wp-signals" v2.0.0 plugin presents a mixed security posture. On the positive side, it demonstrates good practices regarding SQL query handling by exclusively using prepared statements, and it has no known historical vulnerabilities (CVEs). This suggests a potentially well-maintained and audited codebase in the past.

However, significant concerns arise from the static analysis. The plugin exposes two REST API routes without any permission callbacks, creating a substantial attack surface with direct, unprotected entry points. Furthermore, the taint analysis reveals that all seven analyzed flows involve unsanitized paths, though thankfully these did not escalate to critical or high severity in this analysis. The presence of dangerous functions like `set_time_limit` without clear context can also be a risk if not properly managed. The relatively low percentage of properly escaped output (46%) also indicates a potential for cross-site scripting (XSS) vulnerabilities.

In conclusion, while the absence of historical vulnerabilities and sound SQL practices are strengths, the unprotected REST API endpoints and unsanitized taint flows are critical security weaknesses that require immediate attention. The overall risk is moderate, leaning towards high due to the open attack surface.