Post Hierarchy Menu Security & Risk Analysis

The "post-hierarchy-menu" plugin, in version 0.0.1, exhibits a concerning security posture primarily due to the lack of proper authentication and authorization checks on its AJAX endpoints. While the code boasts no known vulnerabilities historically and utilizes prepared statements for SQL queries, the absence of security controls on two AJAX handlers exposes a significant attack surface. This means any unauthenticated user could potentially trigger these handlers, leading to unintended actions or information disclosure if vulnerabilities exist within their functionality. The limited static analysis also reveals a low percentage of properly escaped output, increasing the risk of cross-site scripting (XSS) attacks. Despite the lack of critical taint flows and dangerous functions, the critical oversight in securing AJAX handlers and the insufficient output escaping practices present immediate risks.