If Menu – Visibility control for Menus Security & Risk Analysis

The "if-menu" plugin version 0.19.2 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query handling and a lack of dangerous functions, significant concerns arise from its attack surface and output sanitization. The presence of a single unprotected REST API route is a critical vulnerability, directly exposing functionality to unauthenticated users. This is further exacerbated by the taint analysis revealing unsanitized paths, indicating a potential for attackers to manipulate data flow within the plugin. The plugin's vulnerability history, though currently showing no unpatched issues, reveals past medium-severity vulnerabilities, with a common theme of missing authorization. This pattern suggests recurring authorization flaws. Overall, the plugin has strengths in its internal code handling but suffers from critical external exposure points and ongoing challenges with proper authorization and sanitization. The unprotected REST API is the most pressing issue that requires immediate attention.