WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Security & Risk Analysis

The "wp-post-author" plugin v3.8.7 exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of prepared SQL statements and properly escaped output, significant concerns remain regarding its attack surface and past vulnerability history. The presence of three AJAX handlers without authentication checks represents a notable risk, as these could be exploited by unauthenticated users to perform unintended actions. Although the static analysis did not reveal any critical taint flows, the plugin's history of six known CVEs, including one critical and one high severity vulnerability, is a significant red flag. The common vulnerability types (SQL Injection, XSS, Missing Authorization, Privilege Management) indicate recurring weaknesses in input sanitization, authorization checks, and privilege handling. This history, combined with the unprotected AJAX endpoints, suggests a pattern of potential security oversights that require careful attention.