WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer Security & Risk Analysis

The 'adminify' v4.1.7 plugin presents a mixed security posture. While the static analysis shows a robust implementation of authorization checks with zero unprotected entry points across AJAX handlers, REST API routes, and shortcodes, and a strong emphasis on nonce checks and capability checks, there are areas for concern. The presence of the `exec` function is a significant red flag, as it allows for arbitrary command execution if not handled with extreme caution and robust input sanitization. Furthermore, the taint analysis, though reporting no critical or high-severity flows, did identify 5 flows with unsanitized paths, which could potentially lead to vulnerabilities if exploited.

The vulnerability history reveals a concerning pattern, with a total of 7 medium-severity CVEs previously documented, including instances of exposure of sensitive information, missing authorization, cross-site scripting, and SQL injection. The fact that the last vulnerability was recorded in early 2026 (though this date is in the future and likely an anomaly, it implies past vulnerabilities) suggests a history of security issues. While there are currently no unpatched CVEs, the recurring types of vulnerabilities indicate potential weaknesses in input validation and authorization logic that may still exist or could be reintroduced.

In conclusion, 'adminify' v4.1.7 has strengths in its access control mechanisms and input validation hygiene for most operations. However, the use of `exec` and the history of medium-severity vulnerabilities, particularly those related to injection and information disclosure, warrant careful attention and ongoing security monitoring. The presence of unsanitized paths in taint analysis, even without critical severity, should be thoroughly investigated.