Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages Security & Risk Analysis

The "freesoul-deactivate-plugins" v2.5.0 plugin exhibits a mixed security posture. While it demonstrates strong adherence to output escaping (98%) and has a good number of capability checks, several areas raise significant concerns. The plugin possesses a substantial attack surface with 30 AJAX handlers, 19 of which lack authentication checks, presenting a direct pathway for unauthorized actions. The presence of the `unserialize` function, a known vector for deserialization vulnerabilities, is also a notable risk. Furthermore, the taint analysis reveals a high number of unsanitized paths (17 out of 27 flows) and a high-severity flow, indicating potential for attackers to manipulate plugin behavior or access unauthorized data.

The plugin's vulnerability history, with two previously disclosed CVEs (one medium and one low severity), including common types like CSRF and information exposure, suggests a past tendency towards vulnerabilities that allow unauthorized actions or data leaks. Although there are currently no unpatched vulnerabilities, the historical pattern combined with the static analysis findings warrants caution. The plugin's strengths lie in its proper output escaping and a decent number of capability checks, but these are overshadowed by the numerous unprotected AJAX endpoints and the identified taint flow issues.

In conclusion, while the plugin has some good security practices, the large number of unprotected AJAX endpoints, the use of `unserialize`, and the concerning taint analysis results present significant risks. The historical vulnerability patterns further reinforce the need for careful monitoring and prompt updates. Users should be aware of the potential for unauthorized plugin deactivation or manipulation.