WP Clone any post type Security & Risk Analysis

The "wp-clone-any-post-type" v3.6 plugin exhibits a mixed security posture. While it demonstrates good practices in avoiding dangerous functions and SQL injection vulnerabilities by using prepared statements, significant concerns arise from its attack surface. The presence of four AJAX handlers, all of which lack authentication checks, creates a considerable risk of unauthorized access and manipulation of plugin functionalities.

Taint analysis reveals flows with unsanitized paths, although no critical or high-severity issues were flagged in this specific analysis. However, the plugin's vulnerability history is a major red flag. With two known CVEs, both currently unpatched and classified as medium severity, and past vulnerabilities including 'Open Redirect' and 'Missing Authorization,' there's a clear pattern of authorization and input validation weaknesses. The most recent vulnerability from April 2025 further emphasizes the ongoing nature of these security flaws.

In conclusion, while the plugin's internal code hygiene for SQL and dangerous functions is commendable, the lack of authentication on critical entry points and a history of unpatched, authorization-related vulnerabilities make it a high-risk plugin. Users should exercise extreme caution and consider alternatives until these issues are addressed.