Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors Security & Risk Analysis

The PublishPress Authors plugin, version 4.13.0, exhibits a mixed security posture. While it demonstrates good practices in many areas, such as a high percentage of prepared SQL statements and proper output escaping, several significant concerns warrant attention. The plugin has a considerable attack surface with 46 total entry points, and a notable portion (16, or 35%) lacks authentication or permission checks, particularly 14 AJAX handlers and 2 REST API routes. This presents a substantial risk of unauthorized access or manipulation if these entry points are not adequately secured by the application layer. Taint analysis reveals 7 flows with unsanitized paths, although none are classified as critical or high severity, this still indicates potential for subtle vulnerabilities if inputs are not handled carefully. The plugin's vulnerability history is a significant concern, with 3 known CVEs, including 2 high-severity and 1 medium-severity issues. The common vulnerability types (PHP Remote File Inclusion, SQL Injection, Authorization Bypass) suggest a recurring pattern of weaknesses in input validation and access control. The most recent vulnerability was documented in May 2025, indicating ongoing security challenges. Overall, while some technical security measures are well implemented, the combination of a large unprotected attack surface and a history of serious vulnerabilities suggests a moderate to high risk, requiring careful monitoring and prompt patching of any discovered issues.