mowomo Variable Fonts Security & Risk Analysis

The "mowomo-variable-fonts" v1.1.0 plugin presents a significant security risk due to its unprotected AJAX handlers. The static analysis reveals 6 AJAX handlers, all of which lack authentication checks. This means any user, regardless of their role or permissions, can trigger these actions, potentially leading to unauthorized operations or information disclosure. While the plugin uses prepared statements for SQL queries and has no recorded vulnerabilities, the absence of security checks on its primary entry points is a major concern. The lack of nonce and capability checks, combined with a low rate of output escaping (only 10%), further exacerbates the risk. The plugin's history of no reported vulnerabilities is positive but does not negate the immediate threats posed by the current code. The overall security posture is weak, with critical vulnerabilities being highly probable given the exposed attack surface. Users should exercise extreme caution or avoid using this plugin until these security flaws are addressed.