Ace User Management Security & Risk Analysis

The 'ace-user-management' plugin version 2.6 presents a mixed security posture. While it demonstrates good practices in output escaping, with 100% of outputs properly handled, and a moderate adoption of prepared statements for SQL queries (58%), significant concerns remain regarding its attack surface and vulnerability history. The presence of two AJAX handlers without authentication checks is a direct pathway for potential unauthorized actions, and the lack of explicit permission callbacks for its REST API routes (though none are present) suggests a potential future risk if added. The plugin's history is marred by a critical, unpatched vulnerability from late 2025, specifically an 'Authorization Bypass Through User-Controlled Key'. This indicates a recurring pattern of serious authorization flaws, which is a major red flag for the plugin's overall security maturity and maintenance.