CM Ad Changer – A simple tool to control and optimize your site's banners Security & Risk Analysis

The "cm-ad-changer" v2.0.7 plugin presents a mixed security posture. While it demonstrates some good practices, such as a reasonable number of nonce and capability checks relative to its attack surface, significant concerns remain. The presence of 7 AJAX handlers, with 3 lacking proper authentication checks, creates direct entry points that could be exploited by unauthenticated users. Furthermore, the use of the dangerous `unserialize` function, coupled with only 32% of output being properly escaped, raises concerns about potential code injection and cross-site scripting vulnerabilities. The plugin's vulnerability history, including one high and two medium severity CVEs, with common types being CSRF and XSS, further underscores these risks, even though no currently unpatched vulnerabilities are listed. The last vulnerability being in the recent past suggests that ongoing security issues have been addressed, but the historical pattern of CSRF and XSS indicates potential weaknesses in input sanitization and CSRF protection.