DropAvif Image Optimizer – Convert WebP & AVIF | Compress Images Security & Risk Analysis

The plugin 'dropavif-media-optimizer' v1.2.4 exhibits a generally strong security posture, with all identified entry points (AJAX handlers and REST API routes) correctly implementing authentication and permission checks. The code demonstrates good practices by utilizing prepared statements for the vast majority of its SQL queries and properly escaping a high percentage of its output. The absence of any recorded vulnerabilities in its history further reinforces this positive assessment, indicating a commitment to secure development or effective maintenance. However, the presence of the 'exec' dangerous function warrants attention, as it represents a potential avenue for command injection if not handled with extreme care and strict input validation. While taint analysis did not reveal any exploitable flows, the inherent risk associated with 'exec' remains a notable concern. Overall, the plugin is well-secured in terms of common web vulnerabilities, but the explicit use of a dangerous function requires vigilance.