Image Meta Save Security & Risk Analysis

The "image-meta-save" v1.0 plugin exhibits a concerning security posture primarily due to a significant number of unprotected AJAX handlers. While the plugin demonstrates good practices in its use of prepared statements for SQL queries and has no recorded vulnerability history, the presence of 7 AJAX handlers without any authentication or capability checks presents a substantial attack surface. The taint analysis reveals 6 high-severity flows with unsanitized paths, indicating that user-supplied input could be manipulated to achieve unintended and potentially malicious outcomes. The absence of nonce checks on these AJAX handlers further exacerbates this risk, allowing for potential cross-site request forgery (CSRF) attacks. Despite the lack of known CVEs and a clean history, the identified code signals and taint analysis results point to a critical need for security hardening, particularly around user input validation and access control for its AJAX endpoints.