Admin User Control Security & Risk Analysis

wordpress.org/plugins/admin-user-control

This plugin adds a useful feature to the administration screen that allows administrators to control the users involved in their operations.

0 active installs v2.0.0 PHP 7.1.24+ WP 5.4+ Updated Unknown
loginlogoutpressmanuserusers
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Download
Safety Verdict

Is Admin User Control Safe to Use in 2026?

Generally Safe

Score 100/100

Admin User Control has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs
Risk Assessment

The "admin-user-control" v2.0.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong practices regarding SQL queries, exclusively using prepared statements, and has no recorded historical vulnerabilities, suggesting a generally well-maintained codebase. The absence of dangerous functions and critical or high-severity taint flows is also reassuring.

However, significant concerns arise from the large attack surface, particularly the 21 unprotected AJAX handlers. This presents a considerable risk of unauthorized actions if these handlers can be triggered without proper authentication or authorization checks. While the plugin includes some nonce and capability checks, their distribution across the entry points is clearly insufficient. The moderate level of unescaped output (50%) also introduces a potential for cross-site scripting (XSS) vulnerabilities, although the taint analysis did not reveal critical or high-severity flows for this.

In conclusion, while the plugin avoids common pitfalls like raw SQL and has a clean vulnerability history, the sheer number of unprotected AJAX endpoints is a major weakness. This, coupled with the moderate output escaping, necessitates careful review and likely remediation to secure these entry points and protect against potential exploits.

Key Concerns

  • Unprotected AJAX handlers
  • Moderate output escaping
  • Large attack surface without auth
Vulnerabilities
None known

Admin User Control Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 17, 2026

Admin User Control Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
23 prepared
Unescaped Output
121
122 escaped
Nonce Checks
5
Capability Checks
13
File Operations
8
External Requests
1
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

100% prepared23 total queries

Output Escaping

50% escaped243 total outputs
Data Flows
4 unsanitized

Data Flow Analysis

6 flows4 with unsanitized paths
submit (includes\acf\includes\admin\tools\class-acf-admin-tool-import.php:81)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
21 unprotected

Admin User Control Attack Surface

Entry Points24
Unprotected21

AJAX Handlers 23

authwp_ajax_admin-user-controladmin-user-control.php:47
authwp_ajax_admin-notification-readauc-notification.php:16
authwp_ajax_acf/field_group/render_field_settingsincludes\acf\includes\admin\admin-field-group.php:39
authwp_ajax_acf/field_group/render_location_ruleincludes\acf\includes\admin\admin-field-group.php:40
authwp_ajax_acf/field_group/move_fieldincludes\acf\includes\admin\admin-field-group.php:41
authwp_ajax_acf/fields/oembed/searchincludes\acf\includes\fields\class-acf-field-oembed.php:36
noprivwp_ajax_acf/fields/oembed/searchincludes\acf\includes\fields\class-acf-field-oembed.php:37
authwp_ajax_acf/fields/page_link/queryincludes\acf\includes\fields\class-acf-field-page_link.php:37
noprivwp_ajax_acf/fields/page_link/queryincludes\acf\includes\fields\class-acf-field-page_link.php:38
authwp_ajax_acf/fields/post_object/queryincludes\acf\includes\fields\class-acf-field-post_object.php:38
noprivwp_ajax_acf/fields/post_object/queryincludes\acf\includes\fields\class-acf-field-post_object.php:39
authwp_ajax_acf/fields/relationship/queryincludes\acf\includes\fields\class-acf-field-relationship.php:38
noprivwp_ajax_acf/fields/relationship/queryincludes\acf\includes\fields\class-acf-field-relationship.php:39
authwp_ajax_acf/fields/select/queryincludes\acf\includes\fields\class-acf-field-select.php:40
noprivwp_ajax_acf/fields/select/queryincludes\acf\includes\fields\class-acf-field-select.php:41
authwp_ajax_acf/fields/taxonomy/queryincludes\acf\includes\fields\class-acf-field-taxonomy.php:44
noprivwp_ajax_acf/fields/taxonomy/queryincludes\acf\includes\fields\class-acf-field-taxonomy.php:45
authwp_ajax_acf/fields/taxonomy/add_termincludes\acf\includes\fields\class-acf-field-taxonomy.php:46
authwp_ajax_acf/fields/user/queryincludes\acf\includes\fields\class-acf-field-user.php:35
noprivwp_ajax_acf/fields/user/queryincludes\acf\includes\fields\class-acf-field-user.php:36
authwp_ajax_query-attachmentsincludes\acf\includes\media.php:35
authwp_ajax_acf/validate_save_postincludes\acf\includes\validation.php:30
noprivwp_ajax_acf/validate_save_postincludes\acf\includes\validation.php:31

Shortcodes 1

[acf] includes\acf\includes\api\api-template.php:928
WordPress Hooks 212
actionadmin_enqueue_scriptsadmin-user-control.php:44
actionplugins_loadedadmin-user-control.php:45
actionplugins_loadedadmin-user-control.php:46
actionadmin_menuadmin-user-control.php:50
actionadmin_initadmin-user-control.php:130
actionadmin_bar_menuauc-login-monitor.php:11
actionadmin_initauc-maintenance.php:16
actioninitauc-maintenance.php:17
actioninitauc-maintenance.php:18
actioninitauc-maintenance.php:19
actioninitauc-maintenance.php:20
filtermanage_maintenance_posts_columnsauc-maintenance.php:21
actionmanage_maintenance_posts_custom_columnauc-maintenance.php:22
actionwp_dashboard_setupauc-maintenance.php:23
actionadmin_footerauc-maintenance.php:99
actionlogin_headerauc-maintenance.php:100
filterlogin_titleauc-maintenance.php:101
actionadmin_bar_menuauc-notification.php:12
actionadmin_footerauc-notification.php:13
actiondelete_postauc-notification.php:14
actioninitauc-notification.php:15
actionwp_dashboard_setupauc-notification.php:17
actioninitincludes\acf\acf.php:181
actioninitincludes\acf\acf.php:182
actioninitincludes\acf\acf.php:183
filterposts_whereincludes\acf\acf.php:186
actionacf/validate_fieldincludes\acf\includes\acf-field-functions.php:326
filterwp_unique_post_slugincludes\acf\includes\acf-field-functions.php:1057
actionacf/validate_field_groupincludes\acf\includes\acf-field-group-functions.php:298
filterwp_unique_post_slugincludes\acf\includes\acf-field-group-functions.php:584
actionacf/save_postincludes\acf\includes\acf-form-functions.php:163
actionswitch_blogincludes\acf\includes\acf-utility-functions.php:106
actioncurrent_screenincludes\acf\includes\admin\admin-field-group.php:34
actionsave_postincludes\acf\includes\admin\admin-field-group.php:35
filterpost_updated_messagesincludes\acf\includes\admin\admin-field-group.php:45
filteruse_block_editor_for_post_typeincludes\acf\includes\admin\admin-field-group.php:46
actionacf/input/admin_enqueue_scriptsincludes\acf\includes\admin\admin-field-group.php:132
actionacf/input/admin_headincludes\acf\includes\admin\admin-field-group.php:133
actionacf/input/form_dataincludes\acf\includes\admin\admin-field-group.php:134
actionacf/input/admin_footerincludes\acf\includes\admin\admin-field-group.php:135
actionacf/input/admin_footer_jsincludes\acf\includes\admin\admin-field-group.php:136
filteracf/input/admin_l10nincludes\acf\includes\admin\admin-field-group.php:140
actionpost_submitbox_misc_actionsincludes\acf\includes\admin\admin-field-group.php:226
actionedit_form_after_titleincludes\acf\includes\admin\admin-field-group.php:227
filterscreen_settingsincludes\acf\includes\admin\admin-field-group.php:231
actioncurrent_screenincludes\acf\includes\admin\admin-field-groups.php:38
actiontrashed_postincludes\acf\includes\admin\admin-field-groups.php:39
actionuntrashed_postincludes\acf\includes\admin\admin-field-groups.php:40
actiondeleted_postincludes\acf\includes\admin\admin-field-groups.php:41
actionload-edit.phpincludes\acf\includes\admin\admin-field-groups.php:42
actionadmin_enqueue_scriptsincludes\acf\includes\admin\admin-field-groups.php:102
actionadmin_footerincludes\acf\includes\admin\admin-field-groups.php:103
filtermanage_edit-acf-field-group_columnsincludes\acf\includes\admin\admin-field-groups.php:107
actionmanage_acf-field-group_posts_custom_columnincludes\acf\includes\admin\admin-field-groups.php:108
filterviews_edit-acf-field-groupincludes\acf\includes\admin\admin-field-groups.php:364
actionadmin_footerincludes\acf\includes\admin\admin-field-groups.php:392
actionadmin_noticesincludes\acf\includes\admin\admin-notices.php:130
actionadmin_menuincludes\acf\includes\admin\admin-tools.php:33
actionadmin_menuincludes\acf\includes\admin\admin-upgrade.php:23
actionnetwork_admin_menuincludes\acf\includes\admin\admin-upgrade.php:25
actionadmin_noticesincludes\acf\includes\admin\admin-upgrade.php:46
actionswitch_blogincludes\acf\includes\admin\admin-upgrade.php:97
actionnetwork_admin_noticesincludes\acf\includes\admin\admin-upgrade.php:106
actionadmin_menuincludes\acf\includes\admin\admin.php:23
actionadmin_enqueue_scriptsincludes\acf\includes\admin\admin.php:24
actionadmin_body_classincludes\acf\includes\admin\admin.php:25
filteruser_search_columnsincludes\acf\includes\ajax\class-acf-ajax-query-users.php:27
filterposts_orderbyincludes\acf\includes\api\api-helpers.php:1459
filteracf/settings/uploaderincludes\acf\includes\api\api-helpers.php:3697
filterterms_clausesincludes\acf\includes\api\api-term.php:193
actioninitincludes\acf\includes\assets.php:31
filteracf/validate_fieldincludes\acf\includes\compatibility.php:23
filteracf/validate_field/type=textareaincludes\acf\includes\compatibility.php:24
filteracf/validate_field/type=relationshipincludes\acf\includes\compatibility.php:25
filteracf/validate_field/type=post_objectincludes\acf\includes\compatibility.php:26
filteracf/validate_field/type=page_linkincludes\acf\includes\compatibility.php:27
filteracf/validate_field/type=imageincludes\acf\includes\compatibility.php:28
filteracf/validate_field/type=fileincludes\acf\includes\compatibility.php:29
filteracf/validate_field/type=wysiwygincludes\acf\includes\compatibility.php:30
filteracf/validate_field/type=date_pickerincludes\acf\includes\compatibility.php:31
filteracf/validate_field/type=taxonomyincludes\acf\includes\compatibility.php:32
filteracf/validate_field/type=date_time_pickerincludes\acf\includes\compatibility.php:33
filteracf/validate_field/type=userincludes\acf\includes\compatibility.php:34
filteracf/validate_field_groupincludes\acf\includes\compatibility.php:35
filteracf/field_wrapper_attributesincludes\acf\includes\compatibility.php:38
filteracf/location/validate_rule/type=post_taxonomyincludes\acf\includes\compatibility.php:41
filteracf/location/validate_rule/type=post_categoryincludes\acf\includes\compatibility.php:42
actionacf/initincludes\acf\includes\compatibility.php:45
filterget_media_item_argsincludes\acf\includes\fields\class-acf-field-file.php:36
filterget_media_item_argsincludes\acf\includes\fields\class-acf-field-image.php:41
actionacf/save_postincludes\acf\includes\fields\class-acf-field-taxonomy.php:50
actionacf/ajax/query_users/initincludes\acf\includes\fields\class-acf-field-user.php:311
filteracf/ajax/query_users/argsincludes\acf\includes\fields\class-acf-field-user.php:312
filteracf/ajax/query_users/resultincludes\acf\includes\fields\class-acf-field-user.php:313
filteracf/ajax/query_users/search_columnsincludes\acf\includes\fields\class-acf-field-user.php:314
actionacf/enqueue_uploaderincludes\acf\includes\fields\class-acf-field-wysiwyg.php:40
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:62
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:63
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:69
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:70
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:71
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:75
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:78
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:79
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:88
filteracf_the_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:91
filteracf_the_editor_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:277
filteracf_the_editor_contentincludes\acf\includes\fields\class-acf-field-wysiwyg.php:286
actionacf/input/admin_enqueue_scriptsincludes\acf\includes\fields\class-acf-field.php:65
actionacf/input/admin_headincludes\acf\includes\fields\class-acf-field.php:66
actionacf/input/form_dataincludes\acf\includes\fields\class-acf-field.php:67
filteracf/input/admin_l10nincludes\acf\includes\fields\class-acf-field.php:68
actionacf/input/admin_footerincludes\acf\includes\fields\class-acf-field.php:69
actionacf/field_group/admin_enqueue_scriptsincludes\acf\includes\fields\class-acf-field.php:73
actionacf/field_group/admin_headincludes\acf\includes\fields\class-acf-field.php:74
actionacf/field_group/admin_footerincludes\acf\includes\fields\class-acf-field.php:75
actionadmin_enqueue_scriptsincludes\acf\includes\forms\form-attachment.php:33
filterattachment_fields_to_editincludes\acf\includes\forms\form-attachment.php:37
filterattachment_fields_to_saveincludes\acf\includes\forms\form-attachment.php:41
actionadmin_footerincludes\acf\includes\forms\form-attachment.php:74
actionadmin_enqueue_scriptsincludes\acf\includes\forms\form-comment.php:34
filtercomment_form_field_commentincludes\acf\includes\forms\form-comment.php:38
actionedit_commentincludes\acf\includes\forms\form-comment.php:45
actioncomment_postincludes\acf\includes\forms\form-comment.php:46
actionadmin_footerincludes\acf\includes\forms\form-comment.php:112
actionadd_meta_boxes_commentincludes\acf\includes\forms\form-comment.php:113
actioncustomize_controls_initincludes\acf\includes\forms\form-customizer.php:32
actioncustomize_preview_initincludes\acf\includes\forms\form-customizer.php:33
actioncustomize_saveincludes\acf\includes\forms\form-customizer.php:34
filterwidget_update_callbackincludes\acf\includes\forms\form-customizer.php:38
actionacf/input/admin_footerincludes\acf\includes\forms\form-customizer.php:66
filteracf/pre_load_valueincludes\acf\includes\forms\form-customizer.php:243
filteracf/pre_load_referenceincludes\acf\includes\forms\form-customizer.php:244
actionacf/validate_save_postincludes\acf\includes\forms\form-front.php:65
filteracf/pre_save_postincludes\acf\includes\forms\form-front.php:69
actionenqueue_block_editor_assetsincludes\acf\includes\forms\form-gutenberg.php:24
actionacf/validate_save_postincludes\acf\includes\forms\form-gutenberg.php:27
actionadd_meta_boxesincludes\acf\includes\forms\form-gutenberg.php:44
actionblock_editor_meta_box_hidden_fieldsincludes\acf\includes\forms\form-gutenberg.php:47
filterfilter_block_editor_meta_boxesincludes\acf\includes\forms\form-gutenberg.php:50
actionadmin_enqueue_scriptsincludes\acf\includes\forms\form-nav-menu.php:25
actionwp_update_nav_menuincludes\acf\includes\forms\form-nav-menu.php:26
actionacf/validate_save_postincludes\acf\includes\forms\form-nav-menu.php:27
actionwp_nav_menu_item_custom_fieldsincludes\acf\includes\forms\form-nav-menu.php:28
filterwp_get_nav_menu_itemsincludes\acf\includes\forms\form-nav-menu.php:31
filterwp_edit_nav_menu_walkerincludes\acf\includes\forms\form-nav-menu.php:32
actionadmin_footerincludes\acf\includes\forms\form-nav-menu.php:62
actionload-post.phpincludes\acf\includes\forms\form-post.php:26
actionload-post-new.phpincludes\acf\includes\forms\form-post.php:27
filterwp_insert_post_empty_contentincludes\acf\includes\forms\form-post.php:30
actionsave_postincludes\acf\includes\forms\form-post.php:31
actionadd_meta_boxesincludes\acf\includes\forms\form-post.php:63
actionedit_form_after_titleincludes\acf\includes\forms\form-post.php:144
actionadmin_enqueue_scriptsincludes\acf\includes\forms\form-taxonomy.php:36
actioncreate_termincludes\acf\includes\forms\form-taxonomy.php:40
actionedit_termincludes\acf\includes\forms\form-taxonomy.php:41
actiondelete_termincludes\acf\includes\forms\form-taxonomy.php:45
actionadmin_footerincludes\acf\includes\forms\form-taxonomy.php:116
actionadmin_enqueue_scriptsincludes\acf\includes\forms\form-user.php:29
actionlogin_form_registerincludes\acf\includes\forms\form-user.php:30
actionshow_user_profileincludes\acf\includes\forms\form-user.php:33
actionedit_user_profileincludes\acf\includes\forms\form-user.php:34
actionuser_new_formincludes\acf\includes\forms\form-user.php:35
actionregister_formincludes\acf\includes\forms\form-user.php:36
actionuser_registerincludes\acf\includes\forms\form-user.php:39
actionprofile_updateincludes\acf\includes\forms\form-user.php:40
filterregistration_errorsincludes\acf\includes\forms\form-user.php:43
filteracf/pre_load_valueincludes\acf\includes\forms\form-user.php:193
actionacf/input/admin_footerincludes\acf\includes\forms\form-user.php:251
actionadmin_enqueue_scriptsincludes\acf\includes\forms\form-widget.php:40
actionin_widget_formincludes\acf\includes\forms\form-widget.php:41
actionacf/validate_save_postincludes\acf\includes\forms\form-widget.php:42
filterwidget_update_callbackincludes\acf\includes\forms\form-widget.php:46
actionacf/input/admin_footerincludes\acf\includes\forms\form-widget.php:84
actionacf/update_field_groupincludes\acf\includes\json.php:17
actionacf/untrash_field_groupincludes\acf\includes\json.php:18
actionacf/trash_field_groupincludes\acf\includes\json.php:19
actionacf/delete_field_groupincludes\acf\includes\json.php:20
actionacf/include_fieldsincludes\acf\includes\json.php:21
filteracf/get_cache_keyincludes\acf\includes\l10n.php:153
filteracf/load_field_groupsincludes\acf\includes\local-fields.php:513
filteracf/is_field_keyincludes\acf\includes\local-fields.php:532
filteracf/is_field_group_keyincludes\acf\includes\local-fields.php:551
actionacf/include_fieldsincludes\acf\includes\local-fields.php:576
filteracf/pre_load_post_idincludes\acf\includes\local-meta.php:29
filteracf/pre_load_metaincludes\acf\includes\local-meta.php:30
filteracf/pre_load_metadataincludes\acf\includes\local-meta.php:31
filteracf/pre_update_metadataincludes\acf\includes\local-meta.php:101
actionacf/enqueue_scriptsincludes\acf\includes\media.php:26
actionacf/save_postincludes\acf\includes\media.php:27
filterwp_handle_upload_prefilterincludes\acf\includes\media.php:31
filterwp_prepare_attachment_for_jsincludes\acf\includes\media.php:161
actionwp_restore_post_revisionincludes\acf\includes\revisions.php:28
filterwp_save_post_revision_check_for_changesincludes\acf\includes\revisions.php:32
filter_wp_post_revision_fieldsincludes\acf\includes\revisions.php:33
filter_wp_post_revision_fieldsincludes\acf\includes\revisions.php:34
filteracf/validate_post_idincludes\acf\includes\revisions.php:35
filtertabify_posttypesincludes\acf\includes\third-party.php:35
actiontabify_add_meta_boxesincludes\acf\includes\third-party.php:36
filterpts_allowed_pagesincludes\acf\includes\third-party.php:41
filteracf/get_post_typesincludes\acf\includes\third-party.php:46
actiondoing_dark_modeincludes\acf\includes\third-party.php:51
filterpre_set_site_transient_update_pluginsincludes\acf\includes\updates.php:33
filterplugins_apiincludes\acf\includes\updates.php:36
actionwp_upgradeincludes\acf\includes\upgrades.php:450
actionacf/validate_save_postincludes\acf\includes\validation.php:32
actionacf/verify_ajaxincludes\acf\includes\wpml.php:35
filterget_translatable_documentsincludes\acf\includes\wpml.php:38
actionacf/upgrade_500_field_groupincludes\acf\includes\wpml.php:44
actionicl_make_duplicateincludes\acf\includes\wpml.php:45
filteracf/settings/save_jsonincludes\acf\includes\wpml.php:48
filteracf/settings/load_jsonincludes\acf\includes\wpml.php:49
Maintenance & Trust

Admin User Control Maintenance & Trust

Maintenance Signals

WordPress version tested5.6.17
Last updatedUnknown
PHP min version7.1.24
Downloads1K

Community Trust

Rating0/100
Number of ratings0
Active installs0
Developer Profile

Admin User Control Developer Profile

PRESSMAN

20 plugins · 100 total installs

87
trust score
Avg Security Score
90/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Admin User Control

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/admin-user-control/css/login-monitor.css/wp-content/plugins/admin-user-control/css/auc-admin.css/wp-content/plugins/admin-user-control/css/admin-notification.css/wp-content/plugins/admin-user-control/css/admin-maintenance.css/wp-content/plugins/admin-user-control/js/admin-user-control.js
Script Paths
/wp-content/plugins/admin-user-control/js/admin-user-control.js
Version Parameters
admin-user-control/css/login-monitoradmin-user-control/css/auc-adminadmin-user-control/css/admin-notificationadmin-user-control/css/admin-maintenanceadmin-user-control/js/admin-user-control

HTML / DOM Fingerprints

CSS Classes
auc-login-monitor-wrap
Data Attributes
data-actiondata-lifetime
JS Globals
ADMIN_USER_CONTROL_CONST
REST Endpoints
/wp-json/admin-user-control/v1/get_data
FAQ

Frequently Asked Questions about Admin User Control