Rc2i Content Pruning Security & Risk Analysis

The "rc2i-content-pruning" plugin version 1.0.8 presents a significant security concern primarily due to its extensive attack surface exposed without proper authentication. With 20 AJAX handlers and none of them enforcing authentication checks, any unauthenticated user can potentially trigger these functions, leading to unauthorized actions or data manipulation. While the plugin shows strengths in areas like a high percentage of properly escaped output and a good number of nonce and capability checks (though these appear to be misapplied if no authentication is present), these positive aspects are overshadowed by the critical lack of authorization on its entry points. The taint analysis revealing 5 high-severity flows with unsanitized paths, coupled with the lack of authentication on AJAX handlers, strongly suggests the potential for these flows to be exploited by unauthenticated users. The complete absence of known CVEs is a positive sign, but it cannot mitigate the inherent risks posed by the current code structure. The plugin needs immediate attention to secure its AJAX endpoints.