ACME Divi Modules Security & Risk Analysis

The 'acme-divi-modules' v1.3.5 plugin exhibits a mixed security posture. While it avoids dangerous functions and uses prepared statements for all SQL queries, significant concerns exist regarding its attack surface and output sanitization. The presence of two AJAX handlers without authentication checks is a critical oversight, opening potential avenues for unauthorized actions. Furthermore, the fact that 52% of output is not properly escaped increases the risk of cross-site scripting (XSS) vulnerabilities. The taint analysis revealing unsanitized paths, although not classified as critical or high severity in this instance, warrants attention as it indicates potential for data manipulation if exploited in conjunction with other weaknesses.

The plugin's vulnerability history, specifically the presence of one unpatched medium severity CVE related to missing authorization, reinforces the concerns identified in the static analysis. This suggests a recurring pattern of authorization issues. The last vulnerability was in March 2025, implying it might be a recent or ongoing issue. While the absence of critical or high severity CVEs is positive, the existing medium vulnerability combined with the uncovered unprotected entry points suggests a need for immediate attention to strengthen its overall security. The plugin's strengths lie in its avoidance of direct SQL injection vectors and dangerous functions, but these are overshadowed by its susceptibility to authorization bypass and potential XSS attacks due to inadequate output escaping and unprotected AJAX endpoints.