WPGContacts Security & Risk Analysis

This plugin exhibits a generally good security posture, with several positive indicators. The absence of known CVEs and the presence of nonce checks on all AJAX handlers are strong points. The code analysis shows a reasonable approach to output escaping, with a majority of outputs being properly escaped. The taint analysis also reveals no critical or high-severity vulnerabilities related to unsanitized data flows.

However, there are areas for concern that warrant attention. The most significant is the complete lack of prepared statements for its SQL queries. This represents a significant risk for SQL injection vulnerabilities, as any user-controllable input that makes its way into these queries could be exploited. Additionally, while capability checks are present, there is only one detected, which may indicate insufficient authorization controls for certain operations. The presence of file operations and external HTTP requests, while not inherently risky, should be carefully scrutinized for potential vulnerabilities if not properly secured.

Overall, the plugin's vulnerability history is clean, suggesting a relatively secure development process. However, the lack of prepared statements for SQL queries is a critical oversight that significantly elevates the risk profile. While the attack surface is protected by nonce checks, the raw SQL usage poses a substantial threat that needs immediate remediation.