PageTest.ai – AI-Powered A/B and Multivariate Testing for WordPress Security & Risk Analysis

The pagetest-ai v1.0.1 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong coding practices by utilizing prepared statements for all SQL queries and properly escaping all output, indicating a good defense against common injection vulnerabilities. The absence of dangerous functions, file operations, and any known historical vulnerabilities (CVEs) further contributes to a generally positive security outlook. However, a significant concern arises from its attack surface. The plugin exposes two AJAX handlers, both of which lack authentication checks. This creates a direct and unprotected entry point into the plugin's functionality, potentially allowing any unauthenticated user to trigger these actions. While taint analysis did not reveal any explicit unsanitized flows, the lack of authorization on these AJAX handlers is a critical oversight that could be exploited if the actions they perform are sensitive or could lead to undesirable side effects when triggered by unauthorized users.