WP Blockade – Visual Page Builder Security & Risk Analysis

The wp-blockade plugin version 0.9.14 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no recorded vulnerabilities or CVEs. This suggests a generally well-maintained codebase.

However, the static analysis reveals several areas of concern. The plugin has a total of two entry points, with one unprotected AJAX handler, posing a significant risk of unauthorized execution. The taint analysis indicates one flow with an unsanitized path, which, while not flagged as critical or high severity, warrants attention as it could potentially lead to unexpected behavior or exposure if exploited. Furthermore, only one of the two identified entry points has a capability check, and there are no nonce checks implemented for the AJAX handler, leaving it vulnerable to Cross-Site Request Forgery (CSRF) attacks.

While the lack of historical vulnerabilities is a strong positive, the presence of an unprotected AJAX endpoint and an unsanitized path flow represent immediate risks that should be addressed. The plugin's strengths lie in its database interaction security, but its front-end interaction points require more robust access control and sanitization.