Core Web Vitals & PageSpeed Booster Security & Risk Analysis

The 'core-web-vitals-pagespeed-booster' plugin v1.0.28 exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation and output escaping, several concerns are present. The plugin has a notable attack surface with 15 AJAX handlers, one of which is not protected by any authentication checks, posing a significant risk for unauthorized actions. The presence of the `create_function` dangerous function is also a concern, as it can lead to code injection vulnerabilities if not handled with extreme care. Taint analysis, while not revealing critical or high severity flaws, did identify flows with unsanitized paths, which could potentially be exploited in conjunction with other vulnerabilities.

The plugin's vulnerability history shows a pattern of medium severity issues, specifically Missing Authorization and Open Redirects. The fact that one of the two known CVEs remains unpatched, with the last reported vulnerability dated in the future (2025-12-31), is alarming. This indicates a lack of timely patching and potentially an ongoing security oversight. The combination of an unprotected entry point, historical vulnerabilities related to authorization and redirection, and the presence of dangerous functions suggests that this plugin requires careful review and potential remediation before widespread use.

In conclusion, while the plugin incorporates some robust security measures like prepared statements and proper output escaping, the unprotected AJAX handler, historical vulnerability trends, and the presence of dangerous code constructs significantly detract from its overall security. The unpatched CVE is a critical red flag. Users should be cautious and ensure the plugin is updated to address all known vulnerabilities. Further in-depth analysis of the unsanitized path flows is also recommended.