Super Speedy Chat security review
Security › Super Speedy Chat
Security score 100/100 · Version 1.21.1 · Reviewed 5 November 2026 · Source fingerprint 33835af
Summary
We reviewed the security of Super Speedy Chat on 3 November 2026 and again on 5 November 2026. Version 1.21.1 (commit 33835af) scored 100 out of 100. An AI agent carried out the review against our written security checklist. It traced every route from a request to the code that stores or sends data, and it reproduced each finding on a private test site before and after the fix. The same review scored version 1.20.10 at 65 earlier the same day.
What was found and fixed
SECURITY-001: Visitor contact form could send unlimited notification emails
- Severity: High. Points: 15.
- Problem: when a visitor leaves an email address or phone number, the site emails the support inbox. That request had no rate limit, and every call sent another email, so a script could fill the support inbox and use up the site’s email-sending quota. The recipient was always the site’s own support address, so it could not be used to email anyone else.
- Fix: the contact request now has a per-visitor limit of 5 a minute. The notification goes out only when the details actually change, and at most three times per chat. The details are always saved and shown on the Chats screen.
- Fixed in: 1.21.0.
SECURITY-002: Request limits could be exceeded by sending many requests at once
- Severity: High. Points: 15.
- Problem: the per-visitor limits on the chat endpoints, and the site-wide daily ceilings on AI classifications and on messages relayed to Discord and WhatsApp, each read a stored count, added one and saved it back. Requests arriving at the same moment all read the same count and all passed. In testing, 40 simultaneous requests got through 38 times against a limit of 10.
- Fix: every limit now uses a small database table updated in a single atomic statement, so each request gets its own position in the count. The fastest connection mode (Ultra Ajax) uses the same counter and the same limits as the standard path. In testing, 40 simultaneous requests now get through exactly 10 times in each connection mode, and 30 simultaneous AI requests against a ceiling of 5 make exactly 5 calls.
- Fixed in: 1.21.0.
SECURITY-003: The robot’s AI classification could run more than once per chat
- Severity: Medium. Points: 5.
- Problem: the robot is meant to make at most one paid AI classification per chat. That check only looked for a reply the robot had already written, so when nothing matched, the next request paid for another classification.
- Fix: each chat’s one classification is now reserved before the AI call, and stays reserved whether or not it finds a match. The free site-search suggestions still run.
- Fixed in: 1.21.0.
Switching chat off now closes the visitor endpoints (no points)
- Before 1.21.1, unticking “Enable Chat” hid the chat bubble but left the chat’s visitor endpoints answering. A page cached while chat was on could therefore still start conversations.
- Since 1.21.1, every visitor endpoint answers “chat is switched off” while chat is off. Nothing is stored, emailed or sent to an AI provider. This applies in every connection mode.
- The Ajax Type speed test in the settings still works while chat is off. It uses a one-time secret issued by the server.
- Fixed in: 1.21.1.
Additional hardening in 1.21.0 (no points)
- The Ultra Ajax must-use plugin now exits when its file is requested directly.
- If the new counter cannot be written, visitors get a short “temporarily unavailable” message and the database error goes only to the server’s error log.
- Expired counters are deleted daily, so the hashed visitor IP addresses they contain do not build up on a quiet site.
What the review covered
| Area | Result | Evidence |
|---|---|---|
| Authentication, authorisation and request forgery | Checked | Visitor routes are tied to a random 256-bit chat cookie issued by the server. Admin REST routes require manage_options. Admin Ajax actions check a nonce and a capability. Discord and WhatsApp webhooks verify a shared secret or HMAC signature before changing anything. MCP abilities require the chat management capability. |
| SQL injection | Checked | Every database call in ten classes uses prepared statements or WordPress insert/update formats. Sort orders are allowlisted, and LIKE searches are escaped. Counter keys are built from fixed prefixes, hashes and numbers. |
| Cross-site scripting | Checked | Visitor-supplied names, messages, contact details, page addresses and browser details are escaped in every admin screen and in the chat bubble. Search suggestions only link to the same site. |
| Server-side request forgery, redirects and header injection | Checked | All outbound hosts are fixed (AI providers, Discord, WhatsApp and the licence server). There are no redirects driven by request data. Email header values have line breaks removed. |
| File upload and path traversal | Checked | There is no upload handler of the plugin’s own; media uses the WordPress media picker. File operations only touch the plugin’s fixed must-use plugin path. |
| Code execution and unsafe deserialisation | Checked | No eval, shell commands, includes driven by requests, or unserialize. |
| XML parsing | Not applicable | No XML, SOAP or SVG parsing. |
| Secrets, privacy and data exposure | Checked | API tokens are sent only in request headers to their providers. Settings exports leave secrets out unless asked. The licence key travels in a request header, never in a download address. No visitor IP address is stored. Database errors are logged, not shown to visitors. |
| Business logic, replay and concurrency | Checked | Per-visitor limits, daily AI and relay ceilings, one AI classification per chat and contact-notification limits all use the atomic counter. They were verified under simultaneous load in all three connection modes. WhatsApp message replays are removed by a unique message ID. |
| Dependencies and supply chain | Checked | composer audit reports no advisories. The bundled update checker is current. |
| JWT | Not applicable | No JSON Web Tokens are created or verified. |
| GraphQL | Not applicable | No GraphQL code. |
| Server-side templates | Not applicable | Templates are fixed PHP files. |
Not scored
- Ultra Ajax design trade-off: Ultra Ajax answers chat polling, sending and session requests before WordPress finishes loading. That is where its speed comes from. It therefore does not run other plugins’ REST API restrictions, such as a “disable the REST API for visitors” plugin. When “Require login” is on, chat requests always take the full WordPress path.
- Rate limits use fixed one-minute windows. A visitor can use one window’s allowance at its end and the next window’s at its start.
- The review did not check what the AI providers, Discord or Meta keep of the messages sent to them. That depends on the providers, not on the plugin.
