Yandex.Metrica Security & Risk Analysis

The wp-yandex-metrika plugin, version 1.2.2, exhibits a concerning security posture primarily due to its unprotected attack surface. All five identified AJAX handlers lack authorization checks, presenting a significant risk for unauthorized actions. While the static analysis shows no dangerous functions or raw SQL queries, and external HTTP requests are absent, the lack of basic security controls on entry points is a major weakness. The plugin's vulnerability history, including a known unpatched medium-severity vulnerability (dated in the future, likely a placeholder), indicates a recurring pattern of security oversights, specifically missing authorization. This suggests a need for more robust security practices during development and testing to prevent potential exploits targeting these unprotected AJAX endpoints. Despite the absence of critical taint flows and the proper use of prepared statements, the unprotected entry points and historical vulnerabilities create a notable risk.