Post Blocks & Tools Security & Risk Analysis

The 'bnm-blocks' plugin v1.3.0 presents a mixed security posture. On the positive side, it demonstrates strong practices regarding SQL queries, exclusively using prepared statements, and a very high percentage of properly escaped output, which mitigates many common cross-site scripting risks. The plugin also correctly implements a nonce check and a capability check in one instance, indicating an awareness of core WordPress security mechanisms. However, a significant concern lies in its attack surface. All three identified AJAX handlers lack authentication checks, making them potentially vulnerable to unauthorized actions by unauthenticated users. The presence of the `unserialize` function, a known dangerous function, also raises a red flag, especially when combined with unprotected entry points, as it could be exploited if user-controlled data is passed to it without proper sanitization. While the plugin has a history of a medium-severity CVE related to XSS, it is currently unpatched, which is a major concern. The last vulnerability was in November 2025, which suggests the vulnerability is recent or future-dated and therefore unpatched in the current version. Overall, while the plugin has some good security foundations, the unprotected AJAX endpoints and the use of `unserialize` represent significant risks that require immediate attention.