Ultimate Before After Image Slider & Gallery – BEAF Security & Risk Analysis

The 'beaf-before-and-after-gallery' plugin version 4.7.14 exhibits a mixed security posture. While it demonstrates good practices by using prepared statements for all SQL queries and a high percentage of properly escaped output, there are significant concerns regarding its attack surface and historical vulnerabilities.

The static analysis reveals a notable attack surface with 6 AJAX handlers, and critically, 3 of these lack authentication checks, presenting a direct pathway for potential exploitation if these handlers are susceptible to unauthorized actions. The presence of the `unserialize` function is a known risky function, although no critical or high-severity taint flows were identified in the limited analysis. The plugin also bundles the Select2 library, which could potentially be an outdated or vulnerable component depending on its specific version.

Historically, the plugin has a track record of security issues, with 2 known CVEs. Although none are currently unpatched, the previous vulnerabilities included 'Unrestricted Upload of File with Dangerous Type' and 'Cross-Site Request Forgery (CSRF)', indicating a pattern of weaknesses that could resurface. The last vulnerability was recorded relatively recently, suggesting ongoing security challenges. Despite good internal coding practices in areas like SQL, the external factors of attack surface and historical issues warrant caution.