GetAutoSEO AI Tool Security & Risk Analysis

The getautoseo-ai-content-publisher plugin v1.3.48 presents a mixed security posture. While it demonstrates good practices in many areas, such as the high percentage of SQL queries using prepared statements and properly escaped output, there are significant concerns that warrant attention. The presence of 3 flows with unsanitized paths, two of which are classified as high severity by the taint analysis, is a critical red flag. These flows represent potential avenues for attackers to inject malicious data, leading to compromised integrity or unauthorized actions.

Furthermore, the attack surface includes one REST API route without permission callbacks, which could be exploited if not properly secured by the WordPress core or other security measures. The use of a dangerous `preg_replace(/e)` function is also a concern, as it can lead to code execution vulnerabilities if not handled with extreme care and strict input validation. The plugin's vulnerability history is clean, which is a positive indicator, suggesting proactive development or a lack of prior discovery. However, the current static and taint analysis findings indicate a need for immediate code review and remediation to address the identified high-severity taint flows and the unprotected REST API route.