Kirki – Freeform Page Builder, Website Builder & Customizer Security & Risk Analysis

Kirki v5.2.2 presents a generally good security posture, adhering to several best practices. The absence of known CVEs and a strong reliance on prepared statements for SQL queries are positive indicators. Furthermore, the plugin demonstrates a high percentage of properly escaped output, mitigating common cross-site scripting (XSS) risks. The presence of nonce and capability checks on most entry points is also commendable.

However, a notable concern is the significant attack surface exposed through AJAX handlers. Specifically, 5 out of 7 AJAX handlers lack authentication checks. While no critical taint flows or dangerous functions were identified in the static analysis, the potential for unauthorized execution of code via these unprotected AJAX endpoints represents a significant risk. The plugin's history of zero vulnerabilities further reinforces its current stability, but the identified unprotected AJAX endpoints require immediate attention to maintain this strong security record.

In conclusion, Kirki v5.2.2 benefits from a solid foundation of secure coding practices. The plugin's clean vulnerability history and diligent use of prepared statements and output escaping are strengths. Nevertheless, the unprotected AJAX handlers introduce a considerable security gap that could be exploited. Addressing these unprotected entry points is crucial to prevent potential security incidents and ensure the plugin's continued security.