Export All Posts, Products, Orders, Refunds & Users Security & Risk Analysis

The wp-ultimate-exporter plugin v2.23.1 exhibits a mixed security posture. While it has a reasonable number of AJAX handlers, a significant portion (4 out of 13) lack authentication checks, creating a notable attack surface. The presence of 55 dangerous function calls, particularly 'unserialize', coupled with a high volume of SQL queries with only 35% using prepared statements, raises concerns about potential vulnerabilities if inputs are not rigorously sanitized. The code analysis also identified one flow with an unsanitized path and a high severity taint flow, indicating potential for sensitive data exposure or unauthorized access.

The plugin's vulnerability history is a significant red flag, with 9 known CVEs, including 2 critical and 2 high severity ones. The common vulnerability types like CSRF, Deserialization of Untrusted Data, Path Traversal, and Code Injection are particularly worrying. The fact that there are currently no unpatched CVEs is positive, but the historical pattern suggests a recurring propensity for introducing security flaws. The last vulnerability being recorded in late 2025 is peculiar and might indicate an error in the provided data or a placeholder for future issues.

In conclusion, while the absence of bundled libraries and external HTTP requests are strengths, the numerous unprotected entry points, concerning code signals like 'unserialize' and insufficient SQL preparation, and a history of critical vulnerabilities necessitate a cautious approach. The identified taint flow and unsanitized path are direct evidence of exploitable risks that should be addressed promptly.