Divi Gravity Forms (WP Tools) Security & Risk Analysis

The wp-tools-gravity-forms-divi-module v9.1.0 plugin exhibits a mixed security posture. On the positive side, it shows good practices regarding SQL query handling, with all queries using prepared statements and a high percentage of output being properly escaped. The absence of known vulnerabilities (CVEs) and critical taint analysis findings is also a strong indicator of a secure codebase. However, several concerning areas exist within its attack surface and authorization mechanisms.

The plugin exposes one AJAX handler that lacks authentication checks, presenting a significant risk of unauthorized execution of actions. Additionally, while the REST API routes are secured with permission callbacks, the presence of an unprotected AJAX endpoint is a direct pathway for potential exploitation. The lack of nonce checks on this AJAX handler further exacerbates the risk, making it susceptible to Cross-Site Request Forgery (CSRF) attacks.

In conclusion, while the plugin has strengths in data handling and a clean vulnerability history, the unprotected AJAX endpoint represents a critical weakness that needs immediate attention. The absence of capability checks and nonce validation on this entry point significantly increases the overall risk profile despite other positive security indicators.