WP Duplicate – WordPress Migration Plugin Security & Risk Analysis

The 'local-sync' plugin version 1.1.10 exhibits a concerning security posture, primarily due to a significantly large and unprotected attack surface. With 28 AJAX handlers identified, all of which lack authentication checks, this presents a major entry point for malicious actors to interact with the plugin's functionality without proper authorization. The static analysis also flags the presence of dangerous functions like 'unserialize' and 'exec', which, when combined with the lack of input validation indicated by taint analysis showing flows with unsanitized paths, could lead to severe vulnerabilities such as remote code execution. While the plugin does employ prepared statements for a majority of its SQL queries and shows some effort in output escaping, these positive aspects are overshadowed by the fundamental security flaws in its entry points and handling of potentially dangerous functions. The vulnerability history, including a past critical vulnerability and a pattern of missing authorization issues, further reinforces the perception of a plugin that has historically struggled with robust security. Despite the absence of currently unpatched vulnerabilities and a recent security patch in 2026, the plugin's design remains inherently risky, suggesting that new vulnerabilities could easily be introduced.