AMW Clear Upload Folder Security & Risk Analysis

The "amw-clear-upload-folder" v1.1.5 plugin exhibits a concerning security posture primarily due to its extensive unprotected attack surface and lack of basic security checks. All 12 identified AJAX handlers are exposed without any authentication or capability checks, making them prime targets for unauthorized actions. Furthermore, the presence of the dangerous `unserialize` function, coupled with two high-severity taint flows involving unsanitized paths, indicates a significant risk of arbitrary code execution or data manipulation if malicious data can be injected into these flows.

The plugin also shows a complete absence of nonce checks and capability checks, which are fundamental WordPress security mechanisms. While there is no documented vulnerability history, this is likely due to the plugin not being widely used or analyzed, rather than a sign of inherent security. The poor output escaping (0% properly escaped) further exacerbates the risk, potentially leading to Cross-Site Scripting (XSS) vulnerabilities.

In conclusion, despite having no known CVEs, the plugin's code analysis reveals critical weaknesses. The unprotected AJAX endpoints, dangerous function usage, and unsanitized data flows represent a substantial security risk. Addressing these fundamental security oversights is paramount to mitigating potential exploitation.