WP Delete Post Copies Security & Risk Analysis

The "etruel-del-post-copies" plugin, version 6.0.3, presents a mixed security posture. While it demonstrates good practices by using prepared statements for all SQL queries and having a high rate of output escaping (81%), there are significant concerns. The plugin exposes 9 AJAX handlers, with a third (3) lacking authentication checks, creating a substantial attack surface for unauthorized actions.

Taint analysis reveals 3 flows with unsanitized paths, although these are not categorized as critical or high severity. The vulnerability history shows 2 previously disclosed medium severity CVEs, both related to Cross-Site Scripting and Missing Authorization. The fact that the last vulnerability was in 2025-11-20, while not yet patched, indicates a potential for ongoing security issues or a delay in addressing past problems, especially considering these were not minor vulnerabilities.

Overall, the plugin has strengths in its database interaction and output handling. However, the unprotected AJAX endpoints are a critical security flaw that could be exploited by attackers. The history of medium-severity vulnerabilities related to authorization and XSS further amplifies these concerns. While there are no currently unpatched CVEs, the past issues and the unauthenticated AJAX endpoints warrant careful consideration.