WPtouch – Make your WordPress Website Mobile-Friendly Security & Risk Analysis

The "wptouch" plugin exhibits a mixed security posture. While it demonstrates good practices in several areas, including a high percentage of properly escaped outputs and a significant number of nonce and capability checks, there are notable areas of concern. The static analysis reveals a substantial attack surface, with 3 out of 10 entry points lacking authentication checks. Additionally, the presence of the dangerous `unserialize` function and critical taint analysis flows with unsanitized paths are significant risks. The plugin's vulnerability history is also a cause for concern, with a total of 10 known CVEs, including one critical and four high-severity vulnerabilities. The common vulnerability types such as deserialization, XSS, and SQL injection, coupled with a recent critical vulnerability, suggest a recurring pattern of exploitable weaknesses. This indicates a need for rigorous code review and patching processes to maintain a secure state.