Meta Field Block – Display custom fields in the Block Editor without coding Security & Risk Analysis

The plugin 'display-a-meta-field-as-block' v1.5.2 demonstrates a generally strong security posture. Static analysis reveals no dangerous functions, all SQL queries use prepared statements, and all output is properly escaped. File operations and external HTTP requests are absent, contributing to a reduced attack surface. The presence of capability checks further enhances its security by restricting access to certain functionalities. The limited attack surface, consisting of only two REST API routes with permission callbacks, suggests good security practices in handling entry points.

However, there are areas that warrant attention. The absence of nonce checks on the entry points (AJAX and REST API) is a significant concern, as it could potentially allow for Cross-Site Request Forgery (CSRF) attacks if these endpoints are exploitable. While no critical or high severity taint flows were found, the lack of taint analysis coverage means that potential vulnerabilities might not have been detected. The plugin's vulnerability history shows one past CVE, which was for Cross-site Scripting (XSS), and this vulnerability is currently patched. The existence of a past XSS vulnerability, even if resolved, highlights a potential recurring weakness that needs continuous monitoring.

In conclusion, the plugin has implemented several key security best practices, particularly in data handling and output sanitization. Its attack surface is well-defined and largely protected by permission callbacks. The primary weakness lies in the missing nonce checks for its entry points, which could open the door to CSRF attacks. The past XSS vulnerability also suggests a need for vigilance. Despite these concerns, the plugin's current version appears to be in a relatively secure state, provided the past CVE has been adequately addressed.