NextScripts: Social Networks Auto-Poster Security & Risk Analysis

The plugin "social-networks-auto-poster-facebook-twitter-g" version 4.4.7 presents a mixed security posture with several areas of concern that outweigh its strengths. While it utilizes prepared statements for SQL queries and a significant portion of its output is properly escaped, the presence of unprotected AJAX handlers and dangerous functions like `create_function` and `unserialize` indicates potential vulnerabilities. The history of 14 CVEs, with 2 currently unpatched and a prevalence of high and medium severity issues including Deserialization of Untrusted Data, CSRF, and Improper Access Control, strongly suggests a pattern of recurring security weaknesses.

The static analysis reveals an attack surface with 7 AJAX handlers, 7 of which lack authentication checks, posing a significant risk of unauthorized actions. The use of dangerous functions like `unserialize` without proper sanitization on user-supplied data is a critical concern, potentially leading to deserialization vulnerabilities. Furthermore, the taint analysis shows a high number of flows with unsanitized paths (37), although no critical or high severity flows were explicitly identified in this analysis, the sheer volume suggests a potential for overlooked vulnerabilities.

In conclusion, despite some good security practices in place, the significant number of unprotected entry points, the presence of dangerous functions, and the extensive history of vulnerabilities, particularly those related to deserialization and access control, indicate a substantial risk. The plugin requires immediate attention to address unpatched vulnerabilities and to implement robust authentication and input sanitization for all entry points, especially AJAX handlers.