WP Post Redirection – 301, 404 Redirects Security & Risk Analysis

The 'advance-wp-redirect' v1.0.0 plugin exhibits a significant security concern due to its extensive attack surface with unprotected AJAX handlers. All six identified AJAX entry points lack authentication checks, meaning any authenticated user could potentially trigger these functions, leading to unauthorized actions. While the plugin demonstrates good practices in other areas like using prepared statements for all SQL queries and not engaging in file operations or external HTTP requests (which can be points of vulnerability), the absence of capability checks and nonce verification on its AJAX endpoints is a major weakness. The vulnerability history is clean, with no recorded CVEs, which might suggest a lack of prior scrutiny or that the plugin has been fortunate. However, the static analysis clearly highlights inherent risks that could be exploited if an attacker gains access to an authenticated session. The lack of taint analysis results (0 flows analyzed) is also noteworthy, as it means potentially dangerous data flows might not have been identified.