Flipbox – Awesome Flip Boxes & Image Overlay for WordPress Security & Risk Analysis

The plugin "image-hover-effects-ultimate-visual-composer" v2.10.6 exhibits a mixed security posture. While it demonstrates good practices in several areas, such as a high percentage of prepared SQL statements and properly escaped outputs, there are notable concerns. The static analysis reveals a single unprotected AJAX handler, which represents a significant entry point without proper authentication or authorization checks. This is a critical weakness that could be exploited by an attacker. Furthermore, the taint analysis identified two high-severity flows with unsanitized paths, indicating potential for malicious input to lead to unintended consequences, possibly including arbitrary file access or manipulation.

The vulnerability history, though currently showing no unpatched CVEs, indicates a past high-severity vulnerability related to Authorization Bypass Through User-Controlled Key. This suggests a recurring pattern of authorization weaknesses. The presence of a single unprotected AJAX handler, coupled with past authorization bypass issues and high-severity taint flows, points to potential vulnerabilities in how user input is handled and authorized. While the plugin has strengths in its output escaping and SQL usage, these specific identified weaknesses warrant attention and mitigation.