Nifty Backups – WordPress Backup & Restore Security & Risk Analysis

The Nifty Backups plugin version 1.08 presents a mixed security posture. While it shows some good practices like a single non-critical vulnerability and a limited number of external HTTP requests, several areas raise significant concerns. The static analysis reveals a concerning lack of input validation and authorization checks, particularly with its REST API route and AJAX handlers. The fact that 12 entry points exist, with one being unprotected, is a direct security risk. Furthermore, the low percentage of properly escaped output (16%) indicates a high likelihood of Cross-Site Scripting (XSS) vulnerabilities, which is consistent with its past vulnerability history.

The vulnerability history is a major red flag. A single unpatched medium-severity CVE, identified as Cross-Site Scripting, highlights a persistent weakness in how the plugin handles user input. The timing of this last vulnerability (2025-08-29) suggests it's a recent issue that remains unaddressed. The taint analysis also reveals that all analyzed flows involve unsanitized paths, further reinforcing the concern about improper input handling, even though no critical or high severity issues were flagged here. The high number of file operations (35) combined with poor output escaping and a known XSS history suggests a real possibility of malicious code injection or data leakage.

In conclusion, while Nifty Backups v1.08 avoids dangerous functions and has a decent rate of prepared statements for SQL, its security is significantly undermined by a substantial attack surface with unprotected entry points and a severe deficiency in output escaping. The unpatched XSS vulnerability is a critical issue that needs immediate attention. Users should exercise extreme caution until these issues are rectified.