Blocksy Companion Security & Risk Analysis

The Blocksy Companion plugin, version 2.1.35, presents a mixed security posture. While it demonstrates good practices in areas like SQL query preparedness and a notable absence of critical taint flow issues, significant concerns remain regarding its attack surface and historical vulnerability patterns. A substantial number of AJAX handlers (23 out of 30) lack authentication checks, creating potential entry points for unauthorized actions. This, coupled with the presence of the `unserialize` function, which is inherently risky if not handled with extreme care regarding input sources, elevates the risk profile. The plugin's vulnerability history is also a significant concern, with 9 known CVEs, including one high and eight medium severity issues. The types of past vulnerabilities (Unrestricted Upload, SSRF, XSS, CSRF, Authorization Bypass) indicate a pattern of weaknesses in input validation, authorization, and file handling. Although there are no currently unpatched vulnerabilities, this history suggests a persistent need for rigorous security auditing and development practices. The last vulnerability reported in 2025 further indicates ongoing security challenges.