Seopic – Intelligent SEO images for WordPress Security & Risk Analysis

The seopic-intelligent-seo-images v1.0.0 plugin exhibits several significant security concerns despite a clean vulnerability history. The most critical issue identified is the presence of two AJAX handlers that lack any form of authentication or capability checks. This creates a substantial attack surface, allowing any unauthenticated user to potentially trigger these handlers, leading to unintended actions or data manipulation. Furthermore, the taint analysis reveals two flows with unsanitized paths, indicating a risk of path traversal vulnerabilities, although no critical or high severity issues were flagged here. The limited output escaping also raises concerns about potential cross-site scripting (XSS) vulnerabilities. While the plugin has no recorded CVEs, which is a positive sign, the static analysis strongly suggests that the absence of vulnerabilities is more due to luck than robust security practices. The plugin needs immediate attention to address the unprotected AJAX endpoints and improve output sanitization to mitigate the identified risks.