Multisite Post Duplicator Security & Risk Analysis

The multisite-post-duplicator v1.7.6 plugin presents a significant security risk, primarily due to a substantial attack surface lacking authentication and a known, unpatched high-severity vulnerability. The static analysis reveals 6 AJAX handlers, all of which are unprotected, creating numerous entry points for potential malicious activity. While the plugin demonstrates some good practices, such as the high percentage of SQL queries using prepared statements, these are overshadowed by critical security oversights. The presence of the `unserialize` function, especially in conjunction with unsanitized data flows identified in the taint analysis, is a major concern that could lead to remote code execution or other severe impacts. The vulnerability history, including a known high-severity CVE from 2016 that remains unpatched, strongly indicates a pattern of security neglect and a high likelihood of exploitation.