Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation Security & Risk Analysis

The zero-bs-crm plugin v6.7.3 presents a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of SQL queries using prepared statements and a significant number of nonce and capability checks. The absence of dangerous functions and critical severity taint flows is also encouraging. However, concerns arise from the substantial attack surface, particularly the 9 AJAX handlers lacking authentication checks, which represent a direct entry point for potential exploits. While no critical or high severity CVEs are currently unpatched, the plugin's history of 8 CVEs, including past instances of remote file inclusion, cross-site scripting, and SQL injection, suggests a recurring pattern of vulnerabilities that warrant careful attention. The presence of untrusted data deserialization and flows with unsanitized paths in the taint analysis, although not critical, indicate areas where input validation could be strengthened to prevent potential exploitation. The bundled dompdf library, without information on its version or patch status, could also pose a risk if it's outdated or contains known vulnerabilities.

Overall, while the plugin has strengths in its implementation of secure coding practices, the unauthenticated AJAX endpoints and the historical pattern of various vulnerability types are significant areas of concern. The 6 high severity taint flows, even if not classified as critical, highlight potential weaknesses in input sanitization that could be exploited. The plugin's security would be significantly enhanced by addressing the unprotected AJAX handlers and ensuring all bundled libraries are up-to-date and free from known vulnerabilities. The historical trend of vulnerabilities, even though currently unpatched ones are zero, suggests a need for continuous vigilance and robust security testing.