Authorizer Security & Risk Analysis

The authorizer plugin v3.13.4 exhibits a mixed security posture. While it demonstrates strong output escaping practices and the use of nonces and capability checks, significant concerns arise from its attack surface. A substantial number of AJAX handlers, specifically 8 out of 8, lack authentication checks. This creates a broad entry point for potential exploitation. The presence of the `unserialize` function, a known vector for deserialization vulnerabilities, is also a critical point of attention, though the taint analysis did not reveal critical or high severity unsanitized paths. The plugin has a history of a high-severity vulnerability related to improper input validation, indicating a past weakness in sanitizing user-supplied data. The absence of recent unpatched CVEs is a positive sign, suggesting ongoing maintenance. However, the high proportion of unprotected AJAX endpoints combined with the historical vulnerability type warrants careful consideration.