DK PDF – WordPress PDF Generator Security & Risk Analysis

The dk-pdf plugin exhibits a mixed security posture. While it demonstrates strong practices in areas like SQL query sanitization (100% prepared statements) and a significant majority of output escaping (85%), several critical concerns emerge from the static analysis and vulnerability history. A notable weakness is the presence of 7 unprotected AJAX handlers, representing a substantial attack surface that could be exploited without proper authentication. The taint analysis also reveals 4 flows with unsanitized paths, including 2 of high severity, indicating potential vulnerabilities related to improper input handling that could lead to data compromise or execution of unintended code. The plugin's vulnerability history, with 2 known medium severity CVEs, including SSRF and XSS, reinforces these concerns. Although there are no currently unpatched CVEs, the recurrence of these vulnerability types suggests a pattern of insecure input sanitization that needs to be addressed proactively. The bundled TCPDF library is another area to monitor, as outdated bundled libraries can introduce exploitable vulnerabilities.