Bulk Page Generator – LPagery Security & Risk Analysis

The "lpagery" v2.5.4 plugin exhibits a concerning security posture due to a significant number of unprotected entry points, particularly AJAX handlers. While the plugin demonstrates good practices in SQL query preparation and output escaping, the sheer volume of AJAX endpoints lacking authorization checks presents a substantial attack surface that could be exploited by unauthenticated users to trigger unintended actions. The presence of unsanitized path flows in the taint analysis, although not reaching critical severity, is also a red flag that warrants attention. The plugin's vulnerability history, with a single medium-severity CVE, suggests a past issue but the absence of currently unpatched vulnerabilities is a positive sign. However, the common vulnerability type of 'Missing Authorization' in its history directly correlates with the findings in the static analysis, indicating a recurring weakness that needs to be addressed to improve the plugin's overall security.