Calculated fields for ACF Security & Risk Analysis

The "calculated-fields-for-acf" plugin v1.3.2 exhibits a mixed security posture. On the positive side, the plugin demonstrates excellent SQL query handling by exclusively using prepared statements and shows a good rate of output escaping, with only one output unescaped. It also has no recorded vulnerability history and no flagged dangerous functions, file operations, or external HTTP requests. This suggests a level of care in development regarding common web application vulnerabilities.

However, significant concerns arise from the attack surface analysis. The plugin exposes two AJAX handlers, both of which lack any authentication or capability checks. This creates a substantial risk, as any unauthenticated user could potentially interact with these handlers, leading to unexpected behavior or the exploitation of underlying vulnerabilities if they exist within these handlers. The absence of nonce checks on these AJAX endpoints further exacerbates this risk, making them susceptible to Cross-Site Request Forgery (CSRF) attacks.

The overall security posture is therefore weakened by the presence of unprotected entry points, despite good practices in other areas like SQL and output sanitization. While the lack of historical vulnerabilities is encouraging, the current static analysis reveals a critical security gap that needs immediate attention to mitigate potential risks.