WPMobile.App Security & Risk Analysis

The wpappninja plugin v11.75 presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of SQL queries using prepared statements and a reasonable number of nonce and capability checks, significant concerns exist. The plugin has a considerable attack surface, with 36 total entry points, and notably, 3 of these (AJAX handlers) lack authentication checks, creating potential avenues for unauthorized actions. The taint analysis is particularly concerning, revealing 25 high-severity flows with unsanitized paths, indicating a strong possibility of sensitive data being mishandled or manipulated. Furthermore, only 12% of output is properly escaped, raising the risk of Cross-Site Scripting (XSS) vulnerabilities. The plugin's vulnerability history, with 9 known CVEs including high and medium severity issues like Open Redirect, Code Injection, and XSS, reinforces these concerns. The recency of the last vulnerability (2025) suggests ongoing security challenges, despite no currently unpatched CVEs.