Table Editor Security & Risk Analysis

The wp-table-editor plugin, version 1.6.4, exhibits a mixed security posture. While it demonstrates good practices in SQL query preparedness and output escaping, with high percentages of both, several areas raise concerns. The significant attack surface, particularly the presence of 6 unprotected AJAX handlers, presents a notable risk. Furthermore, the taint analysis reveals 4 high-severity flows with unsanitized paths, indicating potential vulnerabilities in how user-supplied data is processed.

The vulnerability history is a significant red flag, with 2 known CVEs, one of which remains unpatched. The historical prevalence of Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities suggests a recurring pattern of issues related to input validation and authorization. The most recent vulnerability being in August 2025 also indicates a recent history of security flaws.

In conclusion, while the plugin has strengths in its handling of SQL and output, the high number of unprotected entry points, critical taint flows, and an unpatched vulnerability suggest that users should exercise caution. The recurring vulnerability types also warrant attention from the developers to address fundamental security weaknesses.