WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress Security & Risk Analysis

The wp-webhooks plugin v3.4.0 presents a mixed security picture. On the positive side, the static analysis indicates a robust implementation of security measures, with all identified AJAX handlers and REST API routes protected by authentication checks. The plugin also demonstrates a strong adherence to secure coding practices by exclusively using prepared statements for its SQL queries and implementing a significant number of nonce and capability checks. Furthermore, the absence of critical or high-severity taint analysis findings suggests that data sanitization and validation are generally well-handled within the analyzed flows.

However, there are notable areas of concern. The low percentage of properly escaped output (14%) is a significant weakness, suggesting a high risk of Cross-Site Scripting (XSS) vulnerabilities. The presence of 5 flows with unsanitized paths in the taint analysis, even without critical or high severity, indicates potential for Path Traversal vulnerabilities, especially when coupled with the plugin's history.

The plugin's vulnerability history is particularly alarming. Three critical CVEs have been recorded, with common types including Unrestricted File Upload, Deserialization of Untrusted Data, and Path Traversal. While there are currently no unpatched vulnerabilities, the past occurrence of critical issues, particularly Path Traversal and Deserialization, is a strong indicator of past weaknesses that could resurface if not rigorously addressed. The most recent vulnerability being in late 2025 is concerning, as it suggests recent critical issues.

In conclusion, while wp-webhooks v3.4.0 has improved in terms of authentication and SQL practices, the widespread lack of output escaping and the history of critical vulnerabilities, especially Path Traversal and Deserialization, pose significant risks. The 5 unsanitized path flows warrant immediate investigation. The plugin's historical trend with critical issues requires continuous vigilance.