简数采集器 Security & Risk Analysis

The plugin "keydatas" v2.6.4 exhibits a mixed security posture. On the positive side, the static analysis shows excellent adherence to secure coding practices. There are no identified dangerous functions, all SQL queries are properly prepared, and all output is correctly escaped. Furthermore, the absence of external HTTP requests and no identified unsanitized paths in taint analysis are strong indicators of good development hygiene regarding common web vulnerabilities. The presence of nonce and capability checks also suggests an attempt to secure critical operations.

However, the plugin's vulnerability history presents a significant concern. With two known CVEs, including one critical and one medium, it indicates a past history of exploitable flaws. The nature of these past vulnerabilities, "External Control of File Name or Path" and "Unrestricted Upload of File with Dangerous Type," is particularly worrying as they can lead to remote code execution or complete site compromise. The fact that a critical vulnerability was documented as recently as November 2025, even if currently unpatched, suggests that the development team may have struggled with comprehensively addressing security issues in the past.

In conclusion, while the current version of "keydatas" appears to have a robust codebase in terms of static security measures, the historical vulnerability data cannot be ignored. The previous critical and medium severity vulnerabilities, especially those related to file handling, warrant caution. Users should ensure that all historical vulnerabilities have been addressed, and the plugin should be continuously monitored for any new security advisories.