WP Voting Contest Lite Security & Risk Analysis

The wp-voting-contest plugin version 5.8 exhibits a concerning security posture despite some positive indicators. While the use of prepared statements for all SQL queries and a high percentage of properly escaped output are commendable, these strengths are overshadowed by significant weaknesses. The plugin has a large attack surface, with 25 out of 29 entry points (REST API routes) lacking any permission callbacks, leaving them entirely unprotected. This is a critical flaw that could allow unauthorized users to interact with sensitive plugin functionalities.

The vulnerability history further amplifies these concerns. With 3 known CVEs, 2 of which remain unpatched, and a recent vulnerability in August 2025, the plugin has a pattern of security issues. The common vulnerability types of Missing Authorization and Cross-Site Scripting, which align with the identified lack of authorization checks on REST API routes, suggest recurring security design flaws. The presence of a single unsanitized path in the taint analysis, even if not classified as critical or high, is also a point of concern, as it can be a vector for attacks.

In conclusion, while the plugin demonstrates good practices in data handling with prepared SQL and output escaping, the extensive unprotected attack surface and a history of unpatched vulnerabilities, particularly related to authorization, make it a high-risk component. Users should exercise extreme caution and prioritize patching or migrating away from this plugin.