Media Deduper Security & Risk Analysis

wordpress.org/plugins/media-deduper

Save disk space and bring some order to the chaos of your media library by removing and preventing duplicate files.

9K active installs v1.5.9 PHP + WP 4.3+ Updated Dec 3, 2025
adminattachmentsmediaupload
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Media Deduper Safe to Use in 2026?

Generally Safe

Score 100/100

Media Deduper has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 4mo ago
Risk Assessment

The media-deduper plugin version 1.5.9 exhibits a generally good security posture with strong adherence to best practices in most areas. The plugin demonstrates a high percentage of properly escaped outputs and makes extensive use of prepared statements for its SQL queries, significantly mitigating common web vulnerabilities. Its lack of known CVEs and a clean vulnerability history are positive indicators of its security maturity. The presence of nonce checks and capability checks on a majority of its entry points further strengthens its defense against common attacks.

Key Concerns

  • Unprotected AJAX handlers
  • Flow with unsanitized paths
Vulnerabilities
None known

Media Deduper Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Media Deduper Code Analysis

Dangerous Functions
0
Raw SQL Queries
1
5 prepared
Unescaped Output
15
76 escaped
Nonce Checks
6
Capability Checks
5
File Operations
0
External Requests
1
Bundled Libraries
0

SQL Query Safety

83% prepared6 total queries

Output Escaping

84% escaped91 total outputs
Data Flows
1 unsanitized

Data Flow Analysis

3 flows1 with unsanitized paths
screen_tabs (inc\class-media-deduper.php:768)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
2 unprotected

Media Deduper Attack Surface

Entry Points4
Unprotected2

AJAX Handlers 4

authwp_ajax_mdd_index_statusinc\class-media-deduper.php:127
authwp_ajax_mdd_index_stopinc\class-media-deduper.php:128
authwp_ajax_mdd_async_testinc\class-media-deduper.php:130
authwp_ajax_mdd_dismiss_noticeinc\class-media-deduper.php:162
WordPress Hooks 25
actionadmin_noticesinc\class-mdd-admin-notice.php:37
actionadmin_initinc\class-mdd-compat-manager.php:19
filterthe_titleinc\class-mdd-media-list-table.php:102
actioncshp_settings_page_after_section_mddinc\class-media-deduper.php:125
actionadmin_menuinc\class-media-deduper.php:132
actionadmin_enqueue_scriptsinc\class-media-deduper.php:133
actionadmin_initinc\class-media-deduper.php:134
actionadmin_noticesinc\class-media-deduper.php:135
actionadded_post_metainc\class-media-deduper.php:140
actionupdate_post_metadatainc\class-media-deduper.php:141
actiondelete_attachmentinc\class-media-deduper.php:146
filterset-screen-optioninc\class-media-deduper.php:148
filterremovable_query_argsinc\class-media-deduper.php:151
filtermanage_upload_columnsinc\class-media-deduper.php:154
filtermanage_upload_sortable_columnsinc\class-media-deduper.php:155
filtermanage_media_custom_columninc\class-media-deduper.php:156
filtermedia_row_actionsinc\class-media-deduper.php:159
actionpre_get_postsinc\class-media-deduper.php:166
actionupdated_post_metainc\class-media-deduper.php:575
actioninitinc\class-media-deduper.php:1691
actionadmin_menuinc\settings\class-cshp-settings-page.php:52
actionadmin_initinc\settings\class-cshp-settings-section.php:52
actionadmin_initinc\settings\class-cshp-settings-setting.php:89
actionadmin_noticesmedia-deduper.php:31
actionadmin_initmedia-deduper.php:39
Maintenance & Trust

Media Deduper Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedDec 3, 2025
PHP min version
Downloads169K

Community Trust

Rating76/100
Number of ratings43
Active installs9K
Developer Profile

Media Deduper Developer Profile

cornershop

9 plugins · 12K total installs

87
trust score
Avg Security Score
99/100
Avg Patch Time
70 days
View full developer profile
Detection Fingerprints

How We Detect Media Deduper

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/media-deduper/inc//wp-content/plugins/media-deduper/admin/
Script Paths
/wp-content/plugins/media-deduper/media-deduper.js
Version Parameters
media-deduper.js?ver=

HTML / DOM Fingerprints

CSS Classes
mdd-debug-info
Data Attributes
data-mdd-action
JS Globals
media_deduper_admin_object
REST Endpoints
/wp-json/media-deduper/v1/index_status/wp-json/media-deduper/v1/index_stop/wp-json/media-deduper/v1/async_test
FAQ

Frequently Asked Questions about Media Deduper