WP Faster Security & Risk Analysis

The "wp-hash-filename" v1.2 plugin exhibits a strong security posture with no recorded vulnerabilities, CVEs, or identified taint flows. The static analysis reveals no exposed attack surface through AJAX, REST API, shortcodes, or cron events, and all SQL queries utilize prepared statements, demonstrating good development practices. The absence of external HTTP requests and file operations further minimizes potential exposure points.

However, the presence of two "dangerous functions" (create_function) is a notable concern. While no direct exploitation is evident in the static or taint analysis, the use of `create_function` is discouraged in modern PHP as it can lead to security vulnerabilities if not handled with extreme care, particularly regarding input sanitization, which is not explicitly detailed here beyond the zero taint flows. The lack of nonce and capability checks on the (currently non-existent) entry points is also a weakness, although moot in this specific version's configuration.

In conclusion, while the plugin is currently secure based on the provided data and has a clean vulnerability history, the use of `create_function` presents a potential, albeit theoretical, risk that should be addressed. The absence of any external dependencies or complex interactions is a significant strength, contributing to its current low-risk profile.