WP All Import – Listings Import for Inventor WP Security & Risk Analysis

The plugin "import-xml-csv-listings-to-inventor-wp" v1.1.1 exhibits a mixed security posture. On the positive side, it has no recorded vulnerabilities (CVEs) and its SQL queries are all secured with prepared statements, indicating an awareness of common database injection risks. The absence of external HTTP requests and the limited attack surface from a static analysis perspective are also strengths. However, significant concerns arise from the code signals. The presence of the `unserialize` function is a major red flag, as it can be exploited for remote code execution if user-controlled data is passed to it without proper sanitization. Furthermore, the taint analysis reveals a flow with unsanitized paths, specifically of high severity, suggesting a potential pathway for attackers to exploit. The plugin also demonstrates a complete lack of nonce checks and capability checks, leaving any potential entry points vulnerable to CSRF attacks and unauthorized access if they were to be discovered or introduced in future versions.