Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Security & Risk Analysis

The "post-and-page-builder" plugin v1.27.10 presents a mixed security posture. While the plugin demonstrates good practices in handling SQL queries and includes a reasonable number of nonce and capability checks, significant concerns arise from its large attack surface exposed through AJAX handlers without authentication. The presence of 11 unprotected AJAX entry points is a critical weakness, as it allows unauthenticated users to potentially interact with sensitive plugin functionalities.

The taint analysis, although showing no critical or high severity unsanitized flows, did identify 3 flows with unsanitized paths. Combined with the vulnerability history, which shows a concerning pattern of past vulnerabilities including Missing Authorization, CSRF, SSRF, Path Traversal, and XSS, these findings suggest a recurring need for diligent input validation and authorization checks. The plugin's history of 10 medium severity CVEs, even though none are currently unpatched, indicates a historical tendency for exploitable flaws, requiring ongoing vigilance.

In conclusion, the plugin has strengths in its database interaction and some security control implementations. However, the high number of unprotected AJAX endpoints is a major risk. The historical vulnerability patterns reinforce the need for developers to prioritize robust input sanitization and strict access control across all entry points to mitigate potential exploits.