AI Puffer – Your AI engine for WordPress (formerly AI Power) Security & Risk Analysis

The gpt3-ai-content-generator plugin exhibits a mixed security posture. While it demonstrates good practices in SQL query preparation (97% prepared) and output escaping (95% escaped), a significant number of AJAX handlers (188 out of 195) lack proper authentication checks, creating a large attack surface. The taint analysis reveals 29 high-severity flows, indicating potential for exploitation of unsanitized user input, which is a significant concern. The plugin's vulnerability history is extensive, with 10 known CVEs, including a past critical vulnerability. Although there are currently no unpatched vulnerabilities, the recurring types of vulnerabilities (CSRF, Missing Authorization, SSRF, Deserialization, Unrestricted Uploads, XSS) suggest systemic issues with input validation and access control. The presence of outdated bundled libraries like Freemius v1.0 also poses a risk if they contain known vulnerabilities. Overall, the plugin has critical weaknesses in its handling of user input and authorization, despite some strengths in data handling.