WN Flipbox Pro Security & Risk Analysis

The wn-flipbox-pro v2.1 plugin presents a mixed security posture. While it demonstrates good practices in some areas, such as using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns remain. The presence of an unprotected AJAX handler represents a direct entry point that is not adequately secured, increasing the risk of unauthorized actions. Furthermore, the taint analysis revealing a flow with unsanitized paths, even without critical or high severity, warrants attention as it indicates a potential for unexpected behavior or data manipulation.

The vulnerability history, specifically the presence of a currently unpatched medium severity CVE, is a major red flag. The fact that the last vulnerability was in September 2025 suggests a pattern of ongoing security issues that are not being addressed promptly. This historical data, combined with the static analysis findings, points to a plugin that requires immediate attention to patch existing vulnerabilities and address the identified insecure code practices, particularly the unprotected AJAX endpoint and the unsanitized path flow.