Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types Security & Risk Analysis

The wicked-folders plugin v4.1.1 exhibits a mixed security posture. On one hand, static code analysis reveals a strong adherence to modern security practices. The plugin demonstrates excellent control over its attack surface, with zero identified AJAX handlers, REST API routes, shortcodes, or cron events that are unprotected. Furthermore, the code signals indicate robust security measures, with a high percentage of SQL queries using prepared statements, a nearly perfect rate of output escaping, and a substantial number of capability checks. The absence of dangerous functions, file operations, and external HTTP requests is also a positive sign. Taint analysis also found no unsanitized paths, suggesting a low risk of direct code injection or path traversal vulnerabilities originating from the analyzed flows.

However, the plugin's vulnerability history presents a significant concern. A large number of past CVEs (22 total) have been identified, with a notable concentration of medium-severity vulnerabilities. The common vulnerability types, including Authorization Bypass, Cross-Site Request Forgery, Missing Authorization, and SQL Injection, are particularly worrying as they indicate recurring weaknesses in how user inputs and actions are handled. While there are currently no unpatched vulnerabilities, the sheer volume and recurring nature of past issues suggest a need for ongoing vigilance and thorough security auditing. The presence of bundled libraries like Select2 also introduces a potential risk if it's an outdated version, though this is not explicitly detailed in the provided data. The recent vulnerability in 2026 suggests a potential future risk or an error in the data provided.

In conclusion, while wicked-folders v4.1.1 demonstrates good internal coding practices and a limited attack surface from static analysis, its historical vulnerability profile is a substantial red flag. The plugin has a track record of security flaws that have previously been exploited. While the current version appears to have addressed past issues, the recurring types of vulnerabilities suggest potential underlying architectural weaknesses. Users should proceed with caution, ensuring the plugin is consistently updated and closely monitoring for any new security advisories, despite the positive static analysis results.