Revive Social – Social Media Auto Post and Scheduling Automation Plugin Security & Risk Analysis

The "tweet-old-post" v9.3.4 plugin exhibits a mixed security posture. While it demonstrates strengths such as 100% prepared statement usage for SQL queries and a significant number of capability checks, several concerning areas are present. The static analysis reveals a notable attack surface with 3 AJAX handlers, one of which lacks authentication checks, presenting a direct entry point for potential unauthorized actions. Furthermore, the presence of 2 flows with unsanitized paths, although not rated as critical or high severity in the taint analysis, warrants attention as it could lead to unintended behavior or exploitation in specific scenarios. The plugin's vulnerability history is a significant concern, with 3 known CVEs, including one high severity vulnerability related to missing authorization and deserialization of untrusted data. The fact that these past vulnerabilities often involve authorization and deserialization, coupled with the current analysis finding an unprotected AJAX handler and potential unsanitized paths, suggests a recurring pattern of weaknesses in handling user input and access control. The plugin's reliance on the dangerous `unserialize` function also increases its attack surface for deserialization vulnerabilities, even if current taint analysis doesn't flag critical issues. Overall, while some good security practices are in place, the identified unprotected entry point, potential unsanitized paths, and a history of authorization and deserialization vulnerabilities indicate a moderate to high risk. Further investigation into the unprotected AJAX handler and unsanitized paths is crucial.