AWP Classifieds Security & Risk Analysis

The "another-wordpress-classifieds-plugin" v4.4.5 exhibits a mixed security posture. While a high percentage of SQL queries use prepared statements and output escaping is generally robust, significant concerns arise from its attack surface. A substantial number of AJAX handlers (48 out of 51) lack proper authentication checks, creating a large potential entry point for unauthorized actions. Although taint analysis did not reveal critical or high severity flows, the presence of 3 flows with unsanitized paths warrants attention as it could lead to unexpected behavior or potential vulnerabilities if exploited.

The plugin's vulnerability history is a significant red flag, with a total of 10 known CVEs, including one critical and one high severity. The common vulnerability types span a wide range, from code injection and SQL injection to missing authorization and cross-site scripting, indicating recurring security weaknesses in the plugin's development. The most recent vulnerability listed is from 2026-01-16, which is concerning if this is a current version and the vulnerability is indeed unpatched. Despite the recent focus on securing SQL queries and output, the historical pattern and the significant number of unprotected entry points suggest a need for more rigorous security practices.

In conclusion, while the plugin demonstrates some good security practices, the high number of unprotected AJAX endpoints and the concerning vulnerability history outweigh these strengths. The potential for exploitation due to missing authorization on numerous AJAX handlers, combined with past critical and high-severity vulnerabilities, places this plugin at a notable risk. Thorough code review and remediation of past vulnerability types should be a priority.