Master Blocks – Ultimate Gutenberg Blocks for Marketers Security & Risk Analysis

The "ultimate-blocks-for-gutenberg" plugin v1.4.1.4 presents a mixed security posture. On the positive side, it shows good practices with 100% of its SQL queries using prepared statements and a significant percentage (83%) of output properly escaped. The absence of any known CVEs or recorded vulnerability history suggests a generally stable codebase. However, there are notable concerns related to its attack surface. The plugin exposes 11 entry points, with 5 of these, specifically all 5 REST API routes, lacking permission callbacks. This means these routes are accessible without any authentication or authorization checks, creating a significant risk for potential unauthorized actions. Additionally, the presence of a dangerous function like `create_function` is a red flag, as it can be misused in certain contexts to execute arbitrary code. The taint analysis, while showing only two flows, indicates that these flows involve unsanitized paths, which warrants careful investigation to ensure they don't lead to exploitable vulnerabilities.