WappPress – Convert Site to App Fast – WordPress to Mobile App Builder Security & Risk Analysis

The "wapppress-builds-android-app-for-website" plugin v7.0.9 presents a mixed security posture. While it demonstrates good practices in several areas, including 100% prepared SQL statements and a very high percentage of properly escaped output, there are significant areas of concern. The presence of an unprotected AJAX handler represents a direct entry point that could be exploited without proper authentication, posing a notable risk.

The static analysis did not reveal any critical or high-severity taint flows, which is a positive sign. However, the plugin's vulnerability history is a major red flag. With three known CVEs, including a past critical vulnerability, and a recent one on August 7, 2024, it indicates a recurring pattern of security weaknesses. The types of past vulnerabilities – XSS, SSRF, and unrestricted file uploads – are serious and can lead to complete site compromise.

In conclusion, while the current code analysis shows some strengths, the plugin's historical vulnerability record, coupled with the unprotected AJAX handler, necessitates caution. The past critical vulnerability and the recent patching requirement suggest that this plugin has had significant security flaws, and ongoing vigilance is crucial. Users should ensure they are using the latest patched version and monitor for future updates.