Selectable Post and Page Security & Risk Analysis

The "selectable-post-and-page" plugin version 1.3.4 presents several significant security concerns despite a clean vulnerability history. The most critical issue lies in its attack surface, with two AJAX handlers identified, both lacking authentication checks. This means any unauthenticated user could potentially interact with these handlers, leading to unintended consequences or the exploitation of vulnerabilities within them. Additionally, the code signals reveal the use of dangerous functions like `create_function`, which can be a vector for code injection if not handled with extreme care. While the plugin demonstrates good practice by exclusively using prepared statements for SQL queries and has no recorded vulnerabilities, these strengths are overshadowed by the presence of unprotected entry points and insecure coding practices.