Divi Content Restrictor Security & Risk Analysis

The plugin "content-restrictor-for-divi" version 2.0.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, performing all SQL queries using prepared statements, and having no recorded vulnerabilities or CVEs in its history. The absence of file operations and external HTTP requests also reduces potential attack vectors. However, significant concerns arise from the static analysis. The plugin exposes one REST API route without any permission callbacks, creating a direct and unprotected entry point that could be exploited if not properly secured by the surrounding WordPress installation or other plugins. Furthermore, the complete lack of nonce checks and capability checks across all identified entry points is a major weakness, as it allows any authenticated or even unauthenticated user (depending on the REST API endpoint's underlying logic) to potentially trigger actions or access data without proper authorization verification.