LocateAndFilter Security & Risk Analysis

The plugin "locateandfilter" v1.6.17 presents a mixed security posture. While it demonstrates good practices in areas like SQL query sanitization (100% prepared statements) and output escaping (96%), significant concerns arise from its attack surface and vulnerability history. A large number of AJAX handlers (16) lack proper authentication checks, creating a substantial entry point for unauthorized actions. The presence of 72 dangerous function calls, particularly `unserialize`, is a notable risk, especially if user-controlled input can influence serialized data. The vulnerability history shows two medium-severity CVEs, indicating past weaknesses related to missing authorization and cross-site scripting, even though they are currently patched. The pattern of these past vulnerabilities, coupled with the current lack of authorization on many AJAX endpoints, suggests a recurring theme of authorization bypass potential.