WPS Cleaner Security & Risk Analysis

The wps-cleaner plugin version 1.6.10.2 presents a mixed security posture. While it shows strengths such as a high percentage of SQL queries using prepared statements and a good number of nonce and capability checks, significant concerns remain. The presence of an unprotected AJAX handler represents a direct entry point for potential attacks that bypass authentication, which is a critical flaw. Furthermore, the taint analysis revealed a flow with unsanitized paths, indicating a risk of path traversal or similar vulnerabilities, even though it was not classified as critical or high. The plugin's vulnerability history, with two known medium-severity CVEs in the past related to authorization bypass and missing authorization, reinforces the concern about input validation and access control. While the lack of currently unpatched vulnerabilities is positive, the past issues suggest a pattern that warrants caution.