Advanced Export: Export WordPress Site Data Including Widget, Customizer & Media Files Security & Risk Analysis

The "advanced-export" plugin version 1.1.0 demonstrates a mixed security posture. On the positive side, the plugin excels in output escaping, ensuring all 30 outputs are properly sanitized, which is a critical security best practice. It also has no recorded history of vulnerabilities (CVEs), suggesting a history of relatively secure development. The absence of external HTTP requests and bundled libraries further reduces potential attack vectors. However, a significant concern arises from its attack surface. With one AJAX handler identified, and notably, this handler lacks any authentication checks, it presents a direct and unprotected entry point for attackers. While taint analysis shows no critical or high-severity flows, the unprotected AJAX handler is a prime candidate for potential abuse if it handles user-supplied data without proper validation or authorization. The limited number of SQL queries and the fact that 50% use prepared statements is acceptable, but the remaining non-prepared queries could be a minor risk depending on the data they process.