Fonts Plugin | Use Google Fonts, Adobe Fonts or Upload Fonts Security & Risk Analysis

The "olympus-google-fonts" v4.0.6 plugin exhibits a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and a high percentage of properly escaped output, several areas raise concerns. The presence of two unprotected AJAX handlers directly expose entry points without authorization checks, which is a significant risk. Additionally, the plugin's history of three known medium-severity vulnerabilities, including missing authorization, CSRF, and XSS, coupled with the recent discovery on August 16, 2024, suggests a pattern of potentially insecure coding practices that have required patching in the past.

The static analysis reveals a moderate attack surface with a concerning number of unprotected AJAX endpoints. The taint analysis, while limited in scope, did identify two flows with unsanitized paths, although these were not classified as critical or high severity. The plugin also performs file operations and makes external HTTP requests, which, while not inherently insecure, can become vulnerabilities if not handled carefully within the context of the entire application.

Overall, the plugin has strengths in its SQL handling and output escaping. However, the unprotected AJAX handlers and the recurring vulnerability types in its history warrant careful consideration. The recent patch history and the identified unprotected entry points suggest that while efforts are made to secure the code, there remain areas that could be exploited if not thoroughly reviewed and hardened. It is crucial to monitor for any future vulnerabilities and ensure prompt patching.