Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress Security & Risk Analysis

The molongui-authorship plugin v5.2.9 exhibits a mixed security posture. While it demonstrates good practices in output escaping (79% properly escaped) and utilizes nonce checks and capability checks extensively, several concerns warrant attention. The presence of two AJAX handlers without authentication checks represents a significant attack surface, potentially allowing unauthorized actions. The use of the `unserialize` function, even if not directly linked to a critical taint flow in this static analysis, is a known risk factor and should be treated with caution. The plugin's vulnerability history, with six medium severity CVEs, predominantly related to authorization bypass, XSS, and information exposure, suggests a recurring pattern of weaknesses in input validation and access control. Although there are no currently unpatched CVEs, the historical prevalence of these issues indicates a need for ongoing vigilance and robust security development practices. The lack of critical or high severity issues in the current static analysis is a positive sign, but the identified unprotected entry points and historical vulnerabilities prevent a fully confident security assessment.