Erdo Image Optimizer: Compress & Convert to WebP/AVIF (SEO Audit, Alt Text, Lazy Load) Security & Risk Analysis

The erdo-image-optimizer plugin v1.8.5 exhibits a generally strong security posture based on the provided static analysis. A notable strength is the complete absence of unsanitized paths in taint analysis, indicating that user-supplied input is not being directly used in potentially dangerous operations without proper cleaning. The plugin also demonstrates good practices by ensuring all identified AJAX entry points have nonce checks and that all output is properly escaped, which significantly mitigates risks of cross-site scripting (XSS) and other injection vulnerabilities.

However, a significant concern arises from the complete lack of capability checks on its 14 AJAX handlers. While nonce checks are present, they primarily protect against cross-site request forgery (CSRF) attacks by ensuring the request originated from a legitimate WordPress session. They do not, however, verify if the logged-in user has the necessary permissions to perform the action. This means any authenticated user, regardless of their role, could potentially trigger these actions, leading to unintended consequences or unauthorized operations within the plugin's functionality.

Furthermore, the presence of 18 SQL queries, with 22% not using prepared statements, introduces a potential risk of SQL injection. While the majority are protected, any unparameterized query is a vulnerability. The plugin's vulnerability history is clean, with no recorded CVEs, which is a positive sign. This suggests the developers have historically maintained good security. Despite the absence of critical vulnerabilities in the static analysis and a clean history, the lack of capability checks on AJAX handlers and the presence of raw SQL queries without prepared statements are notable weaknesses that warrant attention.