Use Any Font | Custom Font Uploader Security & Risk Analysis

The "use-any-font" plugin v6.3.14 presents a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and has a high percentage of properly escaped outputs. The absence of dangerous functions and bundled libraries is also a strength. However, a significant concern arises from the attack surface analysis, which reveals one AJAX handler without any authentication checks. This represents a direct entry point for potential exploitation.

Taint analysis indicates two flows with unsanitized paths, though thankfully, these did not escalate to critical or high severity issues. While the current version has no unpatched CVEs, the plugin's history of four medium-severity vulnerabilities, including Cross-site Scripting (XSS), Cross-Site Request Forgery (CSRF), and Missing Authorization, is a strong indicator of past security weaknesses. The recent nature of the last vulnerability (September 2024) suggests ongoing attention to security is required.

In conclusion, while the plugin has made strides in secure coding practices like prepared statements and output escaping, the presence of an unprotected AJAX endpoint and a history of past vulnerabilities necessitate caution. The potential for exploitation via the unprotected AJAX handler and the historical patterns of common web vulnerabilities suggest that ongoing vigilance and regular updates are crucial for maintaining security.