Clone Security & Risk Analysis

The wp-clone-by-wp-academy plugin v2.4.8 exhibits several concerning security practices, despite some positive indications. The presence of two AJAX handlers without authentication checks is a significant immediate risk, potentially allowing unauthorized users to trigger sensitive operations. While the taint analysis found no critical or high-severity issues, the overall code signals are mixed. The use of 'unserialize' is a known dangerous function that, if combined with other weaknesses, could lead to severe vulnerabilities. Furthermore, a substantial percentage of SQL queries are not using prepared statements, increasing the risk of SQL injection. The plugin's history of five CVEs, including one critical and one high severity, is a major red flag. This pattern suggests a recurring struggle with fundamental security principles, particularly around deserialization, authorization, and exposure of sensitive information. While the absence of currently unpatched vulnerabilities and the presence of nonce checks are positive, the combination of insecure code practices and a history of past vulnerabilities warrants a cautious approach.