Edwiser Bridge – WordPress Moodle Integration Security & Risk Analysis

The Edwiser Bridge plugin v4.3.3 exhibits a mixed security posture. While it demonstrates good practices with a high percentage of prepared SQL statements and properly escaped output, several areas raise significant concerns. The presence of unprotected AJAX handlers and REST API routes creates potential attack vectors that could be exploited by unauthenticated users. The taint analysis revealing six high-severity flows, even without critical ones, indicates potential for serious vulnerabilities if these flows are not properly handled by application logic.

The plugin's vulnerability history is also a major red flag. With seven known CVEs, including two critical ones and a history of common vulnerability types like missing authorization, XSS, SSRF, and SQL injection, it suggests a pattern of security weaknesses. The recent critical vulnerabilities point towards ongoing issues that may not have been fully addressed. While there are currently no unpatched vulnerabilities, the historical pattern of serious flaws and the static analysis findings of unprotected entry points warrant a cautious approach.

In conclusion, while the plugin has strengths in its basic code hygiene for SQL and output handling, the numerous unprotected entry points and the concerning vulnerability history, particularly the critical vulnerabilities, significantly elevate the risk. Users should exercise extreme caution and ensure they have robust security measures in place.