YMC Filter Security & Risk Analysis

The ymc-smart-filter plugin version 3.8.1 exhibits a mixed security posture. While it demonstrates strengths in areas like SQL query sanitization and output escaping, with a high percentage of properly escaped outputs and a majority of SQL queries using prepared statements, there are significant concerns. The presence of two AJAX handlers without authentication checks creates a direct attack vector, increasing the risk of unauthorized actions. Furthermore, the plugin's history of four known CVEs, including a past critical SQL injection vulnerability and a PHP Remote File Inclusion, alongside medium severity CSRF and XSS, indicates a pattern of exploitable weaknesses. The fact that a critical vulnerability was identified as recently as December 2025, even if currently unpatched, suggests ongoing security challenges and a need for vigilant monitoring. The combination of an unprotected attack surface and a history of serious vulnerabilities outweighs the positive coding practices in terms of immediate risk.