Membership Plugin – Restrict Content Security & Risk Analysis

The restrict-content plugin v3.2.24 presents a mixed security posture. While it demonstrates good practices in output escaping (86%) and a significant number of nonce and capability checks, there are notable areas of concern. The presence of 13 unprotected AJAX handlers represents a substantial attack surface that could be exploited by unauthenticated users. The taint analysis revealed 9 high-severity flows with unsanitized paths, indicating potential vulnerabilities for sensitive data handling or injection attacks. The plugin's vulnerability history is concerning, with 9 known CVEs, including 2 high-severity and 7 medium-severity vulnerabilities, with the most recent one being in 2026. This pattern suggests recurring security weaknesses, particularly in authorization bypass and cross-site scripting, despite the absence of currently unpatched vulnerabilities. The bundled Freemius library also warrants attention, as outdated bundled libraries can introduce risks if not actively maintained. Overall, while there are strengths in some areas of secure coding, the unprotected AJAX endpoints, high-severity taint flows, and a history of significant vulnerabilities point to a plugin that requires careful monitoring and potential remediation.