We want to update a ceiling light fixture in our 1920s home. Al of the wiring has been updated, so I thought this would be straightforward. After buying (a fairly expensive) replacement fixture, I removed the old fixture and discovered that it had been attached to a shallow, pancake-style box that had been affixed to the ceiling surface, using 4 screws that went into the lathe and plaster ceiling. Given how easy the screws were to remove, it didn't inspire a lot of confidence that this was a super-secure way of hanging the fixture. Furthermore, the new fixture comes with a large (mabye 20" diameter) metal medallion piece that sits flush against the ceiling, so the old survace mounted pancake box wouldn't work for the new fixture. After removing the pancake box, I found a simple hole (~1.5") in the ceiling, through which some romex was hanging.

So, now, how to hang the new fixture? Do I need to add a real junction box to the ceiling? Can that just go into the lathe and plaster where the current hole is (which is the center of the room), and if so, how would the new box be affixed to the lathe and plaster ceriling? Or does a new box need to be up against a joist (which would get more invasive...)? The new fixture has a hang weight of 13 lbs, for what that's worth.

Thanks for any advice!