ImgSmaller – Optimize Images | Compress Images | Convert WebP & AVIF Security & Risk Analysis

The imgsmaller v1.0.1 plugin presents a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns arise from its attack surface. A notable 17 out of 23 entry points, including a substantial portion of AJAX handlers and REST API routes, lack proper authentication and permission checks. This creates a wide opening for potential unauthorized access and manipulation. The absence of any recorded vulnerabilities or CVEs in its history is a positive indicator, suggesting diligent maintenance or a lack of past exploitation. However, this historical clean record does not mitigate the immediate risks posed by the identified unprotected entry points. In conclusion, the plugin exhibits strengths in its data handling but suffers from a critical weakness in its access control, necessitating immediate attention to secure its exposed functionalities.