WEDOS | Protection & Cache Performance Security & Risk Analysis

The plugin "wgpwpp" v1.2.2 exhibits a concerning security posture due to a significant number of unprotected entry points and a history of vulnerabilities, particularly related to missing authorization. While the use of prepared statements for SQL queries is a positive practice, it is overshadowed by the fact that all identified AJAX handlers and REST API routes lack proper authentication or permission checks. This creates a wide attack surface that could be easily exploited by unauthenticated users. The presence of the `unserialize` function is another critical red flag, especially in the absence of strict input validation, as it can lead to remote code execution vulnerabilities.

The vulnerability history, with a known unpatched medium severity CVE, further amplifies the risks. The pattern of "Missing Authorization" as a common vulnerability type strongly suggests a recurring oversight in how the plugin handles user permissions, making it a predictable target for attackers. While the plugin demonstrates some good practices like prepared statements, the overwhelming number of unprotected entry points and the historical vulnerability trend point towards a plugin that requires immediate attention and remediation to mitigate severe security risks.