MakeStories (for Google Web Stories) Security & Risk Analysis

The "makestories-helper" v3.0.4 plugin presents a concerning security posture, despite some positive indicators. While it does not utilize dangerous functions and all SQL queries are properly prepared, the plugin exhibits a significant attack surface with 23 unprotected entry points, including 22 AJAX handlers and 1 REST API route without permission callbacks. This lack of authorization checks on a majority of its entry points is a critical weakness, making it highly susceptible to unauthorized actions and privilege escalation.

The static analysis also revealed 4 flows with unsanitized paths, though thankfully none reached critical or high severity in the taint analysis. However, the fact that some unsanitized paths exist, coupled with the large number of unprotected entry points, suggests a real risk of vulnerabilities like Cross-Site Scripting (XSS) or Server-Side Request Forgery (SSRF) if user-supplied data is not handled rigorously. The output escaping, at 73%, is also an area of concern, implying a portion of user-facing output may not be properly sanitized.

The plugin's vulnerability history is particularly troubling, with 4 known CVEs, one of which remains unpatched. The types of past vulnerabilities, including SSRF, Missing Authorization, CSRF, and XSS, directly correlate with the weaknesses identified in the code analysis. The consistent pattern of these vulnerability types indicates recurring security flaws. While the plugin demonstrates good practices in SQL preparation, the pervasive lack of authorization and potential for unescaped output, combined with a history of severe vulnerabilities and an unpatched CVE, necessitates immediate attention to mitigate significant risks to WordPress installations.