Co-Authors Plus Security & Risk Analysis

The "co-authors-plus" plugin v3.7.0 presents a mixed security posture. While it demonstrates strong adherence to secure coding practices in many areas, particularly with a high percentage of prepared SQL statements and properly escaped output, there are notable areas of concern. The presence of two REST API routes without permission callbacks significantly expands the attack surface to potentially unauthenticated users, creating a critical risk. Furthermore, the history of a high-severity "Exposure of Sensitive Information" vulnerability in 2022 suggests a past weakness that, while patched, warrants continued vigilance. The single unsanitized path flow, though not rated as critical or high, also indicates a potential entry point for malicious data manipulation. Overall, the plugin has implemented several good security measures, but the unprotected REST API endpoints and past vulnerability history necessitate careful monitoring and prompt updates.