Metaly for ACF and SCF Security & Risk Analysis

The "metaly-for-acf-and-scf" plugin v1.0.0 exhibits a concerning security posture primarily due to its unprotected AJAX handlers. While the plugin demonstrates good practices in other areas, such as 100% proper output escaping and the use of prepared statements for SQL queries, the presence of three AJAX handlers without any authentication checks represents a significant entry point for potential attacks. This lack of authorization could allow unauthenticated users to trigger arbitrary actions within the plugin, leading to various security issues depending on the functionality exposed. The absence of known CVEs and successful taint analysis for critical or high vulnerabilities is a positive sign, suggesting that the core code might be relatively clean or that the specific functionality doesn't lend itself to common exploitation patterns. However, this does not negate the immediate risk posed by the unprotected AJAX endpoints. The plugin's vulnerability history being clean is reassuring, but it's important to remember that new vulnerabilities can emerge, especially with the identified attack surface.