WPMobile Apps Security & Risk Analysis

The "wpmobile-apps" plugin v1.0.2 presents a mixed security posture. On the positive side, it demonstrates good practices regarding SQL queries, utilizing prepared statements exclusively, and has a clean vulnerability history with no known CVEs. This suggests a degree of developer diligence in addressing known security issues.

However, there are significant concerns arising from the static analysis. The presence of two AJAX handlers without authentication checks creates a direct attack vector for unauthorized actions. Furthermore, the static analysis reveals a concerning trend in output sanitization, with only 3% of outputs being properly escaped. This significantly increases the risk of Cross-Site Scripting (XSS) vulnerabilities, especially when combined with the 8 identified taint flows with unsanitized paths. While these taint flows are not flagged as critical or high severity, the sheer number and lack of sanitization are worrying.

The plugin also utilizes a potentially outdated bundled library, Select2, which could harbor its own unpatched vulnerabilities if not kept up-to-date. The use of the `create_function` is a deprecated and insecure practice that should be avoided. Despite the lack of known CVEs, the identified code signals and taint analysis warrant careful attention and remediation to improve the plugin's overall security.