Media Hygiene: Remove or Delete Unused Images and More! Security & Risk Analysis

The "media-hygiene" plugin v4.0.1 exhibits a mixed security posture. On the positive side, it demonstrates good practices such as extensive use of prepared statements for SQL queries and proper output escaping, with 75% and 90% respectively. The presence of nonces and capability checks on all identified AJAX handlers is also a strong security indicator. However, a significant concern arises from the discovery of one AJAX handler lacking authentication checks, creating a direct entry point for unauthorized actions. Furthermore, taint analysis revealed two high-severity flows with unsanitized paths, indicating potential for injection vulnerabilities if these flows are exposed to user input.

The vulnerability history of this plugin is a notable red flag. While the latest known vulnerability was in 2025, the fact that one out of three total CVEs remains unpatched is a critical issue. The prevalence of "Missing Authorization" as a common vulnerability type in its history suggests a recurring pattern of oversight in securing sensitive functionalities. This, combined with the static analysis finding of an unprotected AJAX handler, reinforces concerns about the plugin's authorization mechanisms. The plugin has strengths in areas like SQL and output sanitization, but the identified authorization flaws and unpatched vulnerability demand attention.