aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory Security & Risk Analysis

The "adirectory" v3.1.3 plugin exhibits a mixed security posture. While it demonstrates good practices in several areas, such as the exclusive use of prepared statements for SQL queries and a high percentage of properly escaped output, significant concerns remain. The presence of 46 AJAX handlers, with two lacking authentication checks, presents a direct attack vector for unauthorized actions. Furthermore, the taint analysis, though reporting no critical or high severity flows, identified five flows with unsanitized paths, indicating potential for path traversal or information disclosure vulnerabilities. The plugin's vulnerability history is a major red flag. With four known CVEs, including one critical and one high severity vulnerability, and a history of common vulnerability types like missing authorization and unrestricted file uploads, it suggests a pattern of recurring security weaknesses. Although there are currently no unpatched vulnerabilities, the historical data indicates a recurring need for diligent patching and a potential underlying architectural fragility. The last reported vulnerability date is in the future, which might be a data anomaly, but the overall history points to a plugin that has struggled with robust security implementations in the past. In conclusion, while "adirectory" v3.1.3 has strengths in data handling and output sanitization, the unprotected entry points, potential for unsanitized paths, and significant historical vulnerability pattern necessitate a cautious approach and diligent monitoring.