WP To Do Security & Risk Analysis

The wp-todo plugin version 2.1.7 exhibits a mixed security posture. While the code demonstrates strong adherence to secure coding practices, such as using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. A total of four AJAX handlers are present, and alarmingly, all of them lack authentication checks. This creates a considerable risk of unauthorized actions being performed on the site. The taint analysis shows no critical or high severity unsanitized paths, which is positive, but the lack of authentication on AJAX endpoints bypasses any potential security checks that might otherwise be present.