ImageEngine – Optimize the Images on Your WordPress Site Like No Other Plugin Security & Risk Analysis

The "image-cdn" plugin v1.2.7 exhibits a mixed security posture. While it demonstrates good practices such as 100% use of prepared statements for SQL queries and a significant percentage of properly escaped output, there are notable areas of concern. The presence of two AJAX handlers without authentication checks presents a direct attack surface that could be exploited by unauthenticated users. This is further compounded by the lack of nonce checks on these unprotected entry points, making them susceptible to Cross-Site Request Forgery (CSRF) attacks. Fortunately, the taint analysis revealed no critical or high-severity unsanitized flows, and the plugin has no recorded vulnerabilities in its history, indicating a lack of past exploitable issues. However, the unprotected AJAX endpoints are a significant weakness that warrants immediate attention and mitigation.