WP All Export – Export Add-On for ACF Security & Risk Analysis

Based on the static analysis, this plugin exhibits a strong security posture. The absence of dangerous functions, file operations, external HTTP requests, and the proper handling of output escaping are all positive indicators. The SQL queries are also partially protected by prepared statements, which is a good practice. The lack of recorded vulnerabilities in its history further suggests a well-maintained and secure codebase.

However, the analysis also highlights a significant concern: the complete absence of nonce checks and capability checks across all potential entry points. While the current static analysis reports zero unprotected entry points (AJAX, REST API, shortcodes, cron events), this is likely because there are no explicit entry points identified in the first place. If any functionality were to be added or discovered later that relied on user interaction or administrative actions without proper authorization and nonce verification, it would represent a critical security gap. The taint analysis also reported zero flows, which is excellent, but this could be due to a lack of complex data flow paths or the inherent limitations of static analysis.

In conclusion, the plugin demonstrates good coding practices by avoiding common pitfalls like dangerous functions and unescaped output. The lack of a vulnerability history is a testament to its perceived stability. The primary weakness lies in the apparent lack of built-in authorization and integrity checks, which, if not addressed, could expose the plugin to significant risks if new entry points are introduced or if its current limited entry points are bypassed.