Live2DWebCanvas Security & Risk Analysis

The 'live-2d' plugin v2.0.0 exhibits a concerning security posture primarily due to a significant lack of authorization checks on its entry points. With 10 unprotected AJAX handlers and REST API routes, this plugin presents a large attack surface that could be exploited by unauthenticated users. While the code shows good practices in SQL query handling with 100% prepared statements and no dangerous function usage, the widespread absence of proper authorization checks on its API endpoints is a critical flaw. The vulnerability history indicates a past high-severity vulnerability related to missing authorization, reinforcing the current findings and suggesting a recurring pattern of insecure access control in this plugin. The taint analysis also highlights two flows with unsanitized paths, though these are not classified as critical or high severity, they still warrant attention given the broader authorization issues. Overall, the plugin has strengths in its database query security but severe weaknesses in access control which significantly increase its risk profile.