Advanced Settings 3 Security & Risk Analysis

The "advanced-settings" v3.3.0 plugin exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and having a substantial number of capability checks, significant concerns remain. The static analysis reveals a notable attack surface, with one AJAX handler lacking authentication checks, which is a direct entry point for potential unauthorized actions.

Furthermore, the plugin's vulnerability history is a serious red flag, with three known CVEs, including one high-severity and two medium-severity vulnerabilities. The common types of vulnerabilities, such as Unrestricted Upload of File with Dangerous Type and Cross-Site Request Forgery (CSRF), indicate recurring security weaknesses. The fact that the last vulnerability was as recent as September 2025 suggests a pattern of security issues that may not be fully addressed or reoccurring.

Overall, while the plugin shows some positive security implementations, the presence of an unprotected AJAX endpoint and a history of significant vulnerabilities necessitate caution. The potential for exploitation due to the unprotected entry point, combined with past occurrences of serious vulnerabilities, makes this plugin a moderate to high-risk component until these issues are thoroughly remediated and validated.