WP Visitor Statistics (Real Time Traffic) Security & Risk Analysis

The wp-stats-manager v8.4 plugin presents a significant security risk due to a large number of unprotected AJAX handlers and a history of numerous vulnerabilities. The static analysis reveals 11 AJAX handlers, all of which lack authentication checks, creating a broad attack surface accessible to any unauthenticated user. Furthermore, the taint analysis indicates 5 high-severity flows with unsanitized paths, suggesting potential for malicious input to be processed in unintended ways, which aligns with the plugin's history of Cross-Site Scripting and SQL Injection vulnerabilities. The presence of the `unserialize` function also poses a risk if user-supplied data is ever passed to it without proper sanitization.

While the plugin demonstrates some good security practices, such as a high percentage of SQL queries using prepared statements and a considerable number of capability checks, these are overshadowed by the critical weaknesses. The vulnerability history is concerning, with 13 known CVEs, including 2 critical and 2 high-severity ones, and importantly, one currently unpatched vulnerability. This pattern of repeated vulnerabilities, particularly those related to authorization, XSS, information exposure, and SQL Injection, suggests recurring security flaws in the development or maintenance of this plugin. The last vulnerability being so recent further emphasizes the ongoing security challenges.

In conclusion, wp-stats-manager v8.4 exhibits a poor overall security posture. The unprotected AJAX endpoints and high-severity unsanitized taint flows represent immediate threats, exacerbated by a concerning track record of exploitable vulnerabilities, including an unpatched critical flaw. While some positive security measures are in place, they are insufficient to mitigate the substantial risks identified.