WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek Security & Risk Analysis

The "ai-content-generation" plugin v1.3.07 presents a mixed security posture. While it demonstrates good practices in many areas, such as a high percentage of properly escaped outputs and the use of prepared statements for most SQL queries, there are significant concerns. The presence of 18 AJAX handlers, with 2 lacking authentication checks, creates a notable attack surface that could be exploited by unauthenticated users. Furthermore, the taint analysis reveals 2 flows with unsanitized paths, indicating potential for directory traversal or other path-related vulnerabilities, even if no critical or high-severity issues were flagged in this specific analysis. The plugin's vulnerability history is a major red flag, with two known medium-severity CVEs, one of which remains unpatched. The recurring "Missing Authorization" vulnerability type suggests a systemic issue in how the plugin handles user permissions, which is directly reflected in the static analysis findings. Overall, the plugin has some strengths in code hygiene, but the unpatched vulnerability and the unprotected AJAX endpoints represent immediate and significant risks.