{"id":18490699,"date":"2025-05-30T10:05:14","date_gmt":"2025-05-30T10:05:14","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/please-improve-plugin-security\/"},"modified":"2025-05-30T10:05:14","modified_gmt":"2025-05-30T10:05:14","slug":"please-improve-plugin-security","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/please-improve-plugin-security\/","title":{"rendered":"Please improve plugin security"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hei,<br \/>I just tested the plugin through WordPress standards and it seems that there are issues that needs to be fixed.<br \/>There are unescaped values in the plugin which can pose a threat to the site security, even when the plugin is only used in admin interface.<br \/>For example:<br \/>$where[] .= &#8216;`object_type<code> = \\'' . $type . '\\'';<br \/><\/code><br \/>Combined with _roles values, which can also have allot of various data, it could potentially lead to escalated privileges.<br \/><\/p>\n","protected":false},"template":"","class_list":["post-18490699","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18490699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/18490699\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=18490699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}