WP Subscription Forms – Subscription Form Plugin for WordPress Security & Risk Analysis

The "wp-subscription-forms" v1.2.5 plugin exhibits a concerning security posture despite some positive code practices. While the plugin shows a decent percentage of SQL queries using prepared statements and a reasonable rate of output escaping, the static analysis reveals significant vulnerabilities. A large attack surface, with 10 out of 11 entry points lacking authorization checks, is a major concern. Furthermore, the taint analysis indicates 8 critical flows with unsanitized paths, suggesting potential for severe exploits like Remote Code Execution or SQL Injection. The plugin's vulnerability history, including 3 known CVEs with a past high-severity SQL Injection and PHP Remote File Inclusion, reinforces these concerns. These historical patterns, combined with the current code signals, suggest a recurring weakness in secure coding practices, particularly around input validation and authorization.