IOptimizer – Compress, Optimize and Lazy Load Images Security & Risk Analysis

The ioptimizer v1.0.3 plugin exhibits a concerning security posture due to a significant number of unprotected entry points. All identified AJAX handlers and REST API routes lack proper authentication and permission checks, creating a wide attack surface that could be exploited by unauthenticated users. While the plugin demonstrates good practices in preventing SQL injection through the use of prepared statements and has a clean vulnerability history with no known CVEs, the lack of authorization checks on critical entry points is a major oversight. The presence of unsanitized paths in taint analysis flows, although not reaching critical or high severity, is also a red flag that warrants attention. The plugin also shows a low percentage of properly escaped output, increasing the risk of cross-site scripting (XSS) vulnerabilities. Despite the positive aspects like the absence of dangerous functions and a clean vulnerability track record, the severe lack of access control on its entry points significantly elevates the overall risk.