Yeem Contact Form Security & Risk Analysis

The "yeem-contact-form" plugin version 1.0.0 presents a concerning security posture primarily due to its unprotected entry points. While the code signals indicate a lack of dangerous functions, no SQL queries, and a high percentage of output escaping, the presence of five AJAX handlers without any authentication checks is a significant weakness. This means any unauthenticated user could potentially interact with these handlers, opening the door to various attacks.

The taint analysis, although limited in scope with only two flows analyzed, did reveal two flows with unsanitized paths. While these did not escalate to critical or high severity, it suggests a potential for code injection or other vulnerabilities if these paths are exploited in combination with other weaknesses or if the scope of analysis was wider.

The plugin's vulnerability history is clean, with zero known CVEs. This is a positive indicator, suggesting the developers may have good security practices or the plugin hasn't been widely targeted or scrutinized. However, this does not negate the risks identified in the static analysis. The plugin's strengths lie in its internal code quality regarding SQL and output handling, but these are overshadowed by its exposed attack surface.