WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden Security & Risk Analysis

The wp2leads plugin v3.5.5 exhibits significant security concerns, primarily stemming from a vast unprotected attack surface and widespread insecure coding practices. With 94 AJAX handlers, all lacking authentication checks, the plugin exposes a critical vulnerability where any unauthenticated user could potentially trigger plugin functionality. This is further exacerbated by a high number of dangerous function usages, particularly `unserialize`, which can lead to Remote Code Execution if coupled with deserialization vulnerabilities. The taint analysis also reveals a concerning 34 flows with unsanitized paths, including 21 of high severity, indicating potential for data injection or manipulation issues. While the plugin has a history of vulnerabilities, the absence of currently unpatched CVEs is a positive, though the recurring types of vulnerabilities like CSRF and XSS suggest a lack of robust input validation and authorization enforcement in past development cycles. The low percentage of properly escaped output (12%) is a serious red flag for potential XSS vulnerabilities.