bunny.net – WordPress CDN Plugin Security & Risk Analysis

The bunnycdn plugin v3.0.0 presents a mixed security posture. While it demonstrates good practices in areas like using prepared statements for all SQL queries and a significant percentage of properly escaped output, there are notable areas of concern. The presence of two unprotected entry points (one AJAX handler and one REST API route) is a significant risk, as these could be exploited by unauthenticated users. The taint analysis, while not revealing critical or high severity issues, did find 8 flows with unsanitized paths, indicating potential for information disclosure or unexpected behavior if specific input vectors are leveraged.

The vulnerability history shows two known medium severity CVEs, both related to Cross-site Scripting. The fact that the last vulnerability was dated in the future (2025-05-19) suggests this data might be hypothetical or a future projection. If these CVEs were indeed in the wild, it indicates a past struggle with input validation leading to XSS. The absence of currently unpatched vulnerabilities is a positive sign, but the pattern of XSS vulnerabilities warrants continued vigilance. Overall, the plugin has strengths in its database query security but needs to address its exposed entry points and the identified unsanitized paths to improve its security.