PausAR – 3D and AR for Elementor Security & Risk Analysis

The plugin "pausar-3d-ar-for-elementor" v1.3.5 exhibits a generally good security posture due to its consistent use of prepared statements for SQL queries and a very high percentage of properly escaped output. The absence of known vulnerabilities in its history is also a positive indicator. However, a significant security concern arises from the presence of one AJAX handler that lacks authentication checks. This unprotected entry point represents a direct avenue for potential abuse if not properly secured by the application layer. The plugin also lacks explicit nonce checks on its AJAX handlers, which further increases the risk associated with the unprotected entry point. While taint analysis shows no detected vulnerabilities, the unprotected AJAX handler is a critical weakness that needs immediate attention. The bundled Freemius library, if not kept up-to-date, could also introduce risks, although no specific version vulnerabilities are indicated in the provided data.