AMP WP – Google AMP For WP Security & Risk Analysis

The "amp-wp" plugin v1.5.18 presents a mixed security posture. While it demonstrates good practices in its handling of SQL queries and output escaping, with high percentages of prepared statements and properly escaped outputs, significant concerns arise from its attack surface. The presence of two AJAX handlers without authentication checks represents a considerable risk, potentially allowing unauthorized actions if these handlers can be triggered by unauthenticated users. The taint analysis, while limited, did identify one flow with unsanitized paths, though thankfully without critical or high severity implications in this scan. The vulnerability history shows one past medium-severity CVE, identified as CSRF. The fact that this vulnerability is currently patched is a positive sign, but the historical presence of CSRF suggests a need for ongoing vigilance regarding input validation and CSRF protection mechanisms, especially given the unprotected AJAX endpoints.