WP Smart Import : Import any XML File to WordPress Security & Risk Analysis

The "wp-smart-import" plugin v1.1.5 presents a significant security risk primarily due to its large, unprotected attack surface. All 11 AJAX handlers lack authentication checks, making them prime targets for unauthorized actions. While the code demonstrates good practices in SQL query preparation and output escaping, the presence of the `unserialize` function is a critical concern, especially when combined with unsanitized input paths identified in the taint analysis. The taint analysis reveals 9 high-severity flows with unsanitized paths, indicating a strong potential for Remote File Inclusion or similar vulnerabilities.

The plugin's vulnerability history, with 6 known CVEs including 2 critical ones, further exacerbates the risk. The common vulnerability types like PHP Remote File Inclusion and SSRF, coupled with a recent critical vulnerability in 2025, suggest a pattern of exploitable flaws. While there are currently no unpatched vulnerabilities, the historical trend and the static analysis findings point to a plugin that has historically struggled with robust security, requiring diligent patching and careful handling of user-provided data.