Delayed Image Import security review
Security › Delayed Image Import
Security score 100/100 · Version 2.35.0 · Reviewed 3 November 2026 · Source fingerprint 0281f6d
Summary
We reviewed the security of Delayed Image Import 2.34.4 on 3 November 2026, fixed what the review found, and reviewed the result again. Version 2.35.0 scores 100 out of 100. The review was carried out by an AI agent working through our written security checklist, and every confirmed finding was reproduced on a private test site before it was fixed and tested again afterwards.
What was found and fixed
All three findings were fixed in version 2.35.0.
SECURITY-001: image queue fields could be set by any post editor
- Severity: Medium. Points: 25.
- The problem: the plugin stores the image addresses it will download later in post custom fields. Those fields were not marked as protected, so a user who could edit a post, such as a Contributor on their own draft, could add one through the Custom Fields box. The plugin would then download that address on the server and add the image to the Media Library, which a Contributor is not normally allowed to do.
- The fix: the plugin’s fields are now protected post meta. Importers and the plugin itself still write them; the Custom Fields box no longer can.
SECURITY-002: opening a post in wp-admin could start downloads before the permission check
- Severity: Low. Points: 25.
- The problem: the plugin downloads a post’s images when it is opened for editing. That step ran before WordPress checked whether the user could edit the post, so a logged-in user without that permission could start downloads for someone else’s post.
- The fix: the plugin now checks that the user can edit the post before downloading, on the edit screen and on the posts list.
SECURITY-003: image text was not always sanitised
- Severity: Medium. Points: 25.
- The problem: an image’s title, caption and description are saved when the image is downloaded. WordPress filters HTML only when the person whose request triggers the save lacks permission to post unfiltered HTML, so when an administrator’s request did the download, script tags in that text were stored.
- The fix: the text is now sanitised with the same rules Super Speedy Imports uses, whoever’s request downloads the image.
What the review covered
| Area | Result | Evidence |
|---|---|---|
| Authentication, authorisation, object access and request forgery | Checked | Every admin action checks the manage_options capability and its own nonce; there are no logged-out handlers or REST routes; queue fields are protected; in-request downloads need edit rights to the post. |
| SQL injection | Checked | About 35 database calls: fixed SQL, prepared statements, or the plugin’s own table names. |
| Cross-site scripting | Checked | Admin and front-end output escaped for its context; image text sanitised on save. |
| Server-side request forgery, redirects and headers | Checked | Downloads go through WordPress’s safe download functions, which validate every redirect; visitors cannot trigger downloads. |
| File handling and path traversal | Checked | File names and extensions come from the verified image type. |
| Remote code execution and unsafe deserialisation | Checked | No dynamic includes, process calls or unsafe unserialize. |
| XML parsing | Not applicable | The plugin parses no XML. |
| Secrets, privacy and data exposure | Checked | No keys, passwords or personal data in the code or its history. |
| Business logic and concurrency | Checked | Queue, locks and retries traced. |
| Dependencies and supply chain | Checked | The only bundled library is our shared settings module, reviewed at the same version the same day. |
| JWT, GraphQL, server-side templates | Not applicable | None used. |
Not scored
These were looked at and did not cost points, because they could not be confirmed or are deliberate design choices:
- Supplier image addresses containing a dollar sign in one block-theme product image path. We could not make that path run on WooCommerce 11.0.1, so it is unconfirmed; the code was changed to a form that handles such addresses correctly anyway.
- The plugin’s image address filter for WooCommerce placeholders now returns an escaped address. Every WooCommerce use of it already escaped the value; this protects themes that do not.
- Timing between overlapping download workers. Traced in the code, not reproduced.
- Visits to product pages count how often each waiting image is viewed, so popular products download first. This is intended behaviour.