Kodlo Media Manager

Updating to 1.8.7 introduces a new critical security hole: an unauthenticated AJAX handler, `woocommerce_get_refreshed_fragments`, that runs without any login check, plus it leaves two plugin options behind when you uninstall. That makes security worse, not better, and the overall risk stays high. The plugin also claims to support WordPress 7.0, but 7.1 is current, and PHP 8.1 has reached end-of-life, so compatibility is decaying. Don’t update yet—wait for the developer to patch the AJAX issue, and seriously consider switching to a more actively maintained media manager.