AdScale AI Ads Meta/Google Ads Security & Risk Analysis

The adscale-ai plugin version 2.2.17 exhibits a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of SQL queries using prepared statements and properly escaped output. The absence of known CVEs and a history free of recorded vulnerabilities is also a significant strength, suggesting a generally well-maintained codebase. However, the static analysis reveals notable concerns, particularly regarding its attack surface. Two AJAX handlers are present, and critically, both lack authentication checks, creating a direct pathway for unauthenticated actions. Furthermore, the taint analysis indicates two flows with unsanitized paths, both categorized as high severity. These untrusted data flows represent a significant risk, as they could potentially lead to unintended or malicious behavior if exploited. The presence of file operations and external HTTP requests, while not inherently insecure, adds to the overall complexity and potential for vulnerabilities if not handled with extreme care. In conclusion, while the plugin benefits from a clean vulnerability history and good coding practices in certain areas, the unprotected AJAX endpoints and high-severity unsanitized taint flows are critical weaknesses that demand immediate attention.