WebPressor – WebP & AVIF Image Converter, Optimizer & Compressor Security & Risk Analysis

The webpressor-webp-image-converter-optimizer plugin version 1.0.0 presents a significant security risk due to its unprotected AJAX handlers. All 8 identified AJAX entry points lack authentication checks, creating a broad attack surface for potential exploitation. While the plugin demonstrates good practices in other areas, such as using prepared statements for SQL queries and a high rate of output escaping, the absence of authorization for AJAX operations is a critical oversight. The plugin's vulnerability history is clean, with no recorded CVEs, which could indicate a lack of targeted attacks or a recent introduction to the market. However, the current code analysis reveals a high risk that outweighs the absence of past vulnerabilities. The plugin's overall security posture is concerning primarily because of these unprotected AJAX handlers, which could allow unauthorized users to trigger plugin functionalities, potentially leading to data manipulation, denial-of-service, or other malicious actions.