Vayu Blocks – Website Builder for the Block Editor Security & Risk Analysis

The 'vayu-blocks' plugin v1.4.4 exhibits a mixed security posture. While it demonstrates good practices like a high percentage of prepared SQL statements and properly escaped output, significant concerns arise from its attack surface and vulnerability history. The presence of 3 unprotected entry points, including AJAX handlers and REST API routes lacking proper authentication or permission checks, presents an immediate risk. Furthermore, the plugin has a history of 5 known CVEs, with one critical unpatched vulnerability, pointing to recurring security weaknesses. The common vulnerability types (Missing Authorization, XSS, Improper Access Control) and the recent critical vulnerability indicate a pattern of insecure handling of user input and access controls. This plugin requires immediate attention to address the unpatched critical vulnerability and the unprotected entry points to mitigate the risk of exploitation.