FileBird Document Library Security & Risk Analysis

The filebird-document-library v3.0.8 plugin exhibits a mixed security posture. On the positive side, the static analysis reveals a very small attack surface with only one shortcode and no unprotected entry points. There are no identified dangerous functions, file operations, or external HTTP requests, which are good indicators of secure coding practices in those areas. Furthermore, the plugin has 0 currently unpatched CVEs, which is a strong positive sign. The high percentage of properly escaped output is also commendable.

However, there are several areas of concern. The presence of a single SQL query that is not using prepared statements is a significant risk. While the taint analysis found no critical or high severity flows, the fact that 100% of SQL queries are not prepared means there's a potential for SQL injection vulnerabilities if user input is directly incorporated into this query. The complete absence of nonce checks across all entry points is another critical weakness. While the single shortcode has a capability check, relying solely on capability checks without nonces leaves the plugin vulnerable to Cross-Site Request Forgery (CSRF) attacks.

The vulnerability history shows one medium severity CVE for Exposure of Sensitive Information to an Unauthorized Actor, which was recently patched. This indicates a past weakness that, while resolved, highlights the plugin's susceptibility to certain types of attacks. The overall conclusion is that while the plugin has a small attack surface and good output escaping, the lack of prepared statements for SQL and the absence of nonce checks are critical security flaws that significantly increase its risk profile.