Metabase – Post & User Meta Editor Security & Risk Analysis

The Metabase Post User Meta Editor plugin version 0.8.1 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries, has a low number of output operations with a high percentage properly escaped, and includes a nonce check and capability check for its single entry point. There are no known vulnerabilities or CVEs associated with this plugin, and it does not perform file operations or external HTTP requests.

However, a significant concern arises from the presence of one AJAX handler that lacks authentication checks. This unprotected entry point could potentially be exploited by an attacker to interact with the plugin's functionality without proper authorization. While taint analysis and vulnerability history are clean, the unprotected AJAX handler represents a direct and exploitable attack vector that, if not addressed, could lead to unauthorized actions or information disclosure. The plugin's small attack surface is a mitigating factor, but the lack of authorization on an entry point remains a critical weakness.