WP Last Modified Info Security & Risk Analysis

The "wp-last-modified-info" v1.9.6 plugin exhibits a mixed security posture. On the positive side, the static analysis reveals a relatively small attack surface with no identified unprotected entry points and a high percentage of properly escaped output. The absence of critical or high severity taint flows is also reassuring. However, the plugin's history of known vulnerabilities, particularly the prevalence of Missing Authorization, Cross-site Scripting, and Code Injection, raises significant concerns about its past security practices.

The static analysis does highlight some potential weaknesses. The presence of one SQL query that is not using prepared statements is a direct risk for SQL injection. While the specific flow is not detailed as unsanitized, it warrants attention. The plugin also performs one file operation and one external HTTP request, which could be vectors for further exploitation if not handled with extreme care and proper sanitization, although no unsanitized paths were found in the taint analysis.

Despite the absence of currently unpatched CVEs and a good output escaping rate, the plugin's historical pattern of security flaws suggests a need for ongoing vigilance. The types of past vulnerabilities indicate that input sanitization and authorization checks have been areas of weakness. Therefore, while the immediate findings are not dire, the plugin's track record demands a cautious approach. A strength is the presence of nonce and capability checks, indicating some attempt at securing functionalities.