NextGEN Download Gallery Security & Risk Analysis

The plugin "nextgen-download-gallery" v1.6.2 exhibits a mixed security posture. While it demonstrates good practices such as 100% use of prepared statements for SQL queries and a significant percentage of properly escaped output, several critical security concerns are present. The analysis reveals a notable attack surface with two AJAX handlers, both lacking authentication checks, which could allow unauthorized users to trigger potentially sensitive actions. Furthermore, the absence of nonce checks on these AJAX endpoints exacerbates the risk, making cross-site request forgery (CSRF) attacks feasible. The vulnerability history is particularly concerning, with one known medium-severity CVE for Exposure of Sensitive Information to an Unauthorized Actor that remains unpatched. This historical pattern of sensitive information exposure, coupled with the current lack of authentication on AJAX endpoints, suggests a recurring theme of inadequate protection of sensitive data and functionality within the plugin.