Advanced Custom Fields: Extended Security & Risk Analysis

ACF Extended v0.9.2.3 presents a concerning security posture despite some positive indicators. The plugin exhibits a large attack surface with 30 entry points, a significant portion of which (26 AJAX handlers) lack authentication checks. This directly exposes a substantial part of its functionality to unauthenticated users, creating a ripe environment for exploitation. While the use of prepared statements for SQL queries is high (95%), the limited output escaping (30%) is a major red flag, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis also revealed one high-severity flow with unsanitized input, further emphasizing potential injection risks.

The vulnerability history paints a troubling picture of past security issues, with 4 known CVEs including 2 critical and 1 high severity. The types of past vulnerabilities (Improper Privilege Management, Code Injection, XSS, SQL Injection) align with the concerns identified in the static analysis, particularly around unauthenticated access and potential input manipulation. The fact that the last vulnerability was in the future (2026-01-19) suggests a potential data entry error in the provided information, but the pattern of critical and high-severity issues is undeniable. While the plugin demonstrates strengths in its use of prepared SQL statements and some nonce/capability checks, these are overshadowed by the extensive unprotected attack surface and a history of serious security flaws.