PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Security & Risk Analysis

The plugin "revisionary" v3.7.24 presents a mixed security posture. While it demonstrates good practices like a high percentage of prepared SQL statements and properly escaped output, there are significant concerns. The presence of an unprotected AJAX handler is a critical vulnerability, providing an easy entry point for unauthenticated attackers. The taint analysis reveals a substantial number of flows with unsanitized paths, including nine high-severity flows, indicating potential for input manipulation leading to unintended behavior or security bypasses. Although there are no currently unpatched vulnerabilities, the history of two medium-severity CVEs, specifically related to Missing Authorization and Cross-site Scripting, suggests a recurring pattern of issues that require attention. The plugin has strengths in its code hygiene for SQL and output, but the critical unprotected AJAX endpoint and the high number of high-severity taint flows, coupled with past vulnerabilities, elevate the overall risk.