WP-CORS Security & Risk Analysis

The wp-cors plugin v0.2.2 presents a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for SQL queries and properly escaping all identified outputs. There are no file operations or external HTTP requests, and no bundled libraries to worry about outdated versions. However, significant concerns arise from the identified attack surface. A single AJAX handler lacks authentication checks, making it a potential entry point for unauthorized actions. The taint analysis revealed one flow with an unsanitized path, which, while not classified as critical or high severity, still represents a potential risk that needs attention.

The plugin's vulnerability history is a major red flag. With two known CVEs, one of which is currently unpatched, the plugin has a documented history of security flaws. The common vulnerability types, Missing Authorization and Cross-site Scripting, align with the static analysis findings of an unprotected AJAX handler and an unsanitized path. The fact that the last vulnerability was recorded on 2026-01-28, and is still unpatched, suggests a lack of ongoing maintenance and timely security updates, which is a critical concern for any WordPress plugin.

In conclusion, while the plugin has some positive coding practices, the presence of an unprotected AJAX endpoint, a taint flow with an unsanitized path, and a history of unpatched vulnerabilities make it a security risk. The unpatched medium severity vulnerability, coupled with the unprotected entry point, strongly suggests that this plugin should be treated with caution and ideally replaced or updated by its developers.