Tools Engine – AIO Custom Fields Security & Risk Analysis

The "tools-engine" v1.1 plugin exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by using prepared statements for all SQL queries and has a history devoid of known vulnerabilities, suggesting a commitment to security. However, significant concerns arise from its attack surface. A notable portion of its AJAX handlers (7 out of 46) and one REST API route lack proper authentication and permission checks, creating potential entry points for unauthorized actions. The presence of the `unserialize` function is also a cause for concern, as it can be a vector for remote code execution if not handled with extreme care and proper sanitization, although the static analysis did not report any specific exploitable flows. The bundled jQuery library is significantly outdated, posing a risk if any vulnerabilities are present in that specific version and are exploited by attackers.