Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) Security & Risk Analysis

The plugin "bulk-image-alt-text-with-yoast" version 2.2.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices by generally using prepared statements for SQL queries and implementing nonce checks and capability checks for its functions. The absence of file operations and external HTTP requests reduces the potential attack surface in those areas. Taint analysis also revealed no critical or high severity vulnerabilities related to unsanitized paths.

However, significant concerns arise from the analysis of the attack surface. The plugin exposes three AJAX handlers, and critically, all three lack authentication checks. This presents a substantial risk, as any unauthenticated user could potentially trigger these handlers. Furthermore, while the plugin has a history of known vulnerabilities, it currently has no unpatched CVEs, suggesting a reasonable track record for addressing security issues, although the presence of a past medium-severity Cross-Site Scripting vulnerability warrants ongoing vigilance.

In conclusion, while the plugin employs some solid security measures like prepared statements and nonces, the lack of authentication on all its AJAX endpoints is a critical oversight. The history of a past XSS vulnerability also highlights the importance of thorough output escaping, which is only partially implemented (48%). These weaknesses, particularly the unprotected AJAX handlers, outweigh the strengths and suggest a moderate to high risk without further security hardening.