AutoWP – AI Content Writer & Rewriter Security & Risk Analysis

The "autowp-ai-content-writer-rewriter" plugin exhibits a mixed security posture. While it demonstrates good practices in using prepared statements for SQL queries and properly escaping most output, significant concerns remain. The presence of 102 dangerous function calls, particularly `unserialize`, coupled with taint analysis revealing two high-severity flows with unsanitized paths, indicates potential for serious vulnerabilities like Remote Code Execution or Local File Inclusion. Furthermore, the plugin has a history of known vulnerabilities, including a currently unpatched medium-severity issue, and previous medium-severity vulnerabilities included Missing Authorization and CSRF, suggesting recurring patterns of insecure coding practices related to access control and user input validation.

The attack surface is moderate with four AJAX handlers, one of which lacks authentication checks. This unprotected entry point, combined with the identified taint flows and dangerous functions, presents a clear risk. The plugin's reliance on manual capability checks (only one found) further exacerbates this, as it suggests insufficient authorization enforcement across its functionalities. While the plugin has a reasonable number of nonce checks and a relatively clean approach to REST API and shortcodes, the identified high-severity taint flows and the unpatched CVE are the most pressing concerns that significantly elevate the overall risk profile.