QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly Security & Risk Analysis

The "quickwebp" v3.2.7 plugin exhibits a significant security concern due to its entirely unprotected AJAX handlers. While the plugin demonstrates good practices in other areas, such as using prepared statements for all SQL queries and a high percentage of output escaping, the lack of authentication checks on all six AJAX entry points creates a substantial attack surface. Any unauthenticated user could potentially trigger these AJAX actions, leading to unintended consequences or enabling further exploitation. The taint analysis shows no critical or high severity issues, and the plugin has no recorded vulnerability history, which are positive indicators. However, the sheer number of unprotected AJAX endpoints overrides these strengths, making this a pressing concern that requires immediate attention.