AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress Security & Risk Analysis

AutomatorWP v5.6.4 presents a mixed security posture. While the plugin demonstrates good practices in its use of prepared statements for SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface and historical vulnerability patterns. The static analysis reveals a large number of AJAX handlers, with one handler lacking authentication checks, which represents a direct entry point for potential exploitation. Furthermore, the taint analysis highlights a critical severity flow with unsanitized paths, indicating a potential for command injection or similar vulnerabilities if the flow is improperly handled.

The plugin's vulnerability history is particularly concerning, with a total of 9 known CVEs. The past existence of critical and high-severity vulnerabilities, including code injection, missing authorization, SQL injection, XSS, and privilege management issues, suggests a recurring pattern of complex security flaws. Although no currently unpatched vulnerabilities are listed, this history indicates a need for heightened vigilance. The presence of bundled libraries like Select2, while not inherently problematic, can introduce additional risk if not kept up-to-date.

In conclusion, AutomatorWP v5.6.4 has strengths in its SQL query handling and output escaping. However, the combination of a significant unprotected AJAX handler, a critical taint flow, and a history of diverse and severe vulnerabilities necessitates a cautious approach. The potential for attackers to leverage the unprotected entry point or the identified taint flow, coupled with the plugin's past security issues, warrants careful monitoring and prompt patching of any future vulnerabilities.