Additional Authors Security & Risk Analysis

The "additional-authors" plugin version 1.3.5 exhibits a mixed security posture. On the positive side, the plugin shows good practices by avoiding dangerous functions, file operations, and external HTTP requests. The majority of its SQL queries utilize prepared statements, and most output is properly escaped. Furthermore, the absence of known vulnerabilities (CVEs) and taint analysis findings suggests a generally well-maintained codebase.

However, significant concerns arise from the attack surface. The plugin exposes two AJAX handlers, both of which lack authentication checks. This is a critical security weakness, as it allows any user, including unauthenticated ones, to trigger these handlers, potentially leading to unauthorized actions or information disclosure. While there's a nonce check and capability checks present, their effectiveness is diminished by the lack of overall authentication on these entry points.

In conclusion, while the plugin demonstrates strengths in areas like SQL handling and output sanitization, the unprotected AJAX endpoints represent a substantial risk. The vulnerability history is clean, which is a positive indicator, but the present code analysis reveals a clear and actionable security gap that should be addressed immediately.