Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… Security & Risk Analysis

The 'acf-views' plugin version 3.8.3 exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to secure coding practices by utilizing prepared statements for all SQL queries and properly escaping a high percentage of its output. The absence of dangerous functions and critical/high severity taint flows is also a significant strength, indicating a generally well-written codebase.

However, notable concerns arise from the plugin's attack surface. Specifically, one AJAX handler lacks authentication checks, presenting a potential entry point for unauthorized actions. While there are no active unpatched CVEs, the presence of one past high-severity vulnerability, categorized as 'Improper Neutralization of Special Elements Used in a Template Engine', suggests that the plugin has historically been susceptible to complex injection attacks. This history, combined with the unprotected AJAX handler, warrants careful consideration.

In conclusion, while 'acf-views' v3.8.3 shows commendable security development practices in areas like SQL and output handling, the unprotected AJAX endpoint and the history of a high-severity template engine vulnerability are weaknesses that could be exploited. Vigilance is recommended, especially regarding the uncovered AJAX endpoint.