Auth Armor – Passwordless Login Security & Risk Analysis

The "auth-armor-passwordless-login" plugin exhibits a concerning security posture due to a significant attack surface composed entirely of unprotected AJAX handlers. While the plugin demonstrates good practices in other areas, such as using prepared statements for SQL queries and a high percentage of properly escaped output, the lack of authorization checks on these entry points is a critical weakness. This could allow unauthenticated users to trigger potentially sensitive actions or expose information. The presence of the `unserialize` function also poses a risk, as it can lead to remote code execution if used with untrusted input, although the provided taint analysis shows no critical or high severity flows related to this. The plugin's clean vulnerability history is a positive sign, suggesting diligent development or a lack of past exploitation. However, this should not overshadow the immediate risks presented by the unprotected AJAX endpoints and the potential dangers of unserialization.