ZMOOZ Web Stories Security & Risk Analysis

The zmooz-stories plugin exhibits several concerning security practices, particularly regarding its attack surface. With all three identified REST API entry points lacking permission callbacks, there's a significant risk of unauthorized access and manipulation of plugin functionality. While the plugin shows good practices in SQL query preparation and output escaping, the presence of two unsanitized path flows in taint analysis, even without critical severity, suggests a potential for directory traversal or file manipulation vulnerabilities. The complete absence of nonce checks and a single capability check further amplifies the risk associated with its unprotected entry points. The plugin's history of zero known vulnerabilities is a positive sign, suggesting that it might not have been a frequent target or that previous versions were more robust. However, this historical data should not overshadow the immediate risks identified in the current static analysis.