click5 CRM add-on to WPForms Security & Risk Analysis

The "wpf-add-on-by-click5" v1.0.3 plugin exhibits a concerning security posture due to a significant number of unprotected entry points. While the code shows good practices regarding SQL queries and avoids dangerous functions and file operations, the lack of authentication checks on all 9 REST API routes presents a substantial risk. This means any user, regardless of their logged-in status or permissions, could potentially interact with these API endpoints and trigger unintended actions.

The static analysis highlights that 100% of REST API routes are exposed without permission callbacks. Although taint analysis and vulnerability history show no immediate critical flaws or past vulnerabilities, this widespread lack of authorization on entry points is a fundamental security weakness. The presence of external HTTP requests also warrants careful inspection to ensure they do not introduce further vulnerabilities.

In conclusion, the plugin demonstrates strengths in its SQL query handling and absence of known critical vulnerabilities. However, the extensive attack surface presented by unprotected REST API routes significantly outweighs these positives, making it a high-risk plugin that requires immediate attention to implement proper authentication and authorization checks.