Custom Post Types and Custom Fields creator – WCK Security & Risk Analysis

The plugin "wck-custom-fields-and-custom-post-types-creator" v2.3.8 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices in its use of prepared statements for SQL queries and proper output escaping, with high percentages for both. The presence of nonce and capability checks also indicates an awareness of WordPress security fundamentals. However, a significant concern arises from the presence of two AJAX handlers that lack authentication checks. This creates a direct attack vector for unauthenticated users to interact with potentially sensitive functionality. While no critical or high severity taint flows were identified, the six flows with unsanitized paths are concerning and could be a precursor to vulnerabilities if not carefully managed. The plugin's vulnerability history shows one medium-severity Cross-Site Scripting (XSS) vulnerability, last patched in late 2022, suggesting a past weakness that, while addressed, warrants attention regarding the maintainers' ability to prevent such issues.

Overall, the plugin has strengths in its handling of database operations and output, but the unprotected AJAX endpoints represent a clear and immediate risk. The past XSS vulnerability and unsanitized taint flows, though not currently critical, suggest that diligent security reviews and robust input validation are crucial for this plugin. The absence of critical or high severity issues in the static analysis is reassuring, but the identified weaknesses should not be overlooked, especially concerning the direct exposure of AJAX endpoints.