GoCache Security & Risk Analysis

The "gocache-cdn" v1.3.6 plugin presents a significant security risk primarily due to its unprotected AJAX handlers. The static analysis revealed a substantial attack surface with 6 AJAX handlers, all of which lack proper authorization checks. This is a critical vulnerability that could allow unauthenticated users to trigger arbitrary actions within the plugin.

While the plugin shows some good practices, such as using prepared statements for SQL queries and generally good output escaping, these strengths are overshadowed by the fundamental security flaws. The absence of capability checks further exacerbates the risk associated with the unprotected AJAX endpoints. The vulnerability history, showing a known medium severity CVE from 2025-10-17 related to "Missing Authorization," reinforces this concern and indicates a recurring pattern of authorization issues. The fact that this CVE is currently unpatched is a serious red flag.

In conclusion, despite some positive coding practices, the "gocache-cdn" plugin is highly vulnerable. The unprotected AJAX handlers, combined with a history of authorization-related vulnerabilities that remain unpatched, make this plugin a prime target for attackers. Remediation of the authorization checks on AJAX endpoints is paramount.