AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) Security & Risk Analysis

The 'appmysite' plugin v3.15.2 presents a mixed security posture. While it demonstrates strengths such as the absence of dangerous functions and the use of prepared statements for all SQL queries, significant concerns arise from its attack surface. Specifically, two AJAX handlers lack authentication checks, creating potential entry points for unauthorized actions. The plugin also exhibits a history of medium severity vulnerabilities, including missing authorization and exposure of sensitive information, with one such vulnerability remaining unpatched as of September 2025. This pattern suggests recurring security weaknesses that require attention. Although Taint analysis shows no critical or high severity flows, and a good percentage of output is escaped, the unauthenticated AJAX endpoints combined with past authorization issues indicate a notable risk that needs to be addressed.