Zara 4 Image Compression Security & Risk Analysis

The "zara-4" plugin version 1.2.17.2 exhibits a significant security risk due to its completely unprotected attack surface. All 15 identified AJAX handlers lack any form of authentication or capability checks, meaning any unauthenticated user can trigger these functions. While the static analysis shows no dangerous functions, SQL queries are prepared, and output is escaped, these are overshadowed by the severe lack of authorization. The plugin has a history of a medium severity vulnerability related to Missing Authorization, and it is currently unpatched. This pattern, coupled with the current findings of numerous unprotected entry points, strongly suggests a recurring and fundamental flaw in the plugin's security design and implementation regarding access control.