EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time Security & Risk Analysis

The wp-maximum-upload-file-size plugin, version 3.0.4, exhibits a mixed security posture. The static analysis reveals a relatively small attack surface, with all identified entry points (AJAX handlers) appearing to have authentication checks. The plugin also demonstrates good practices in its handling of SQL queries, exclusively using prepared statements, and implements nonce and capability checks. However, a significant concern arises from the taint analysis, which identified two flows with unsanitized paths. While these did not result in critical or high severity issues in this analysis, they represent potential pathways for malicious input to affect the application if not handled properly further downstream. The plugin's vulnerability history shows two past medium severity CVEs, specifically related to "Exposure of Sensitive Information to an Unauthorized Actor" and "Missing Authorization." The fact that the last vulnerability was recently discovered (2024-11-22) and is currently unpatched is a notable risk. Although these past issues are medium severity and there are no currently unpatched CVEs, the historical pattern suggests a need for continued vigilance and robust security practices within the plugin's development lifecycle. The 75% proper output escaping, while decent, also leaves room for improvement, as a quarter of the outputs are not properly escaped, potentially leading to cross-site scripting vulnerabilities if the data originates from an untrusted source.