Authyo OTP for Ninja Forms Security & Risk Analysis

The 'authyo-otp-for-ninja-forms' plugin, version 1.0.4, exhibits a generally good security posture, particularly in its handling of SQL queries, which are 100% prepared, and a high rate of output escaping (87%). The plugin also demonstrates good practice by including nonce checks for its entry points and employing capability checks where appropriate. The absence of recorded vulnerabilities in its history is a positive indicator of past security diligence. However, a significant concern arises from the presence of 7 AJAX handlers, of which 4 lack any authentication checks. This creates a considerable attack surface, potentially exposing the plugin to unauthorized actions if these handlers are not adequately protected by other means. While no critical or high severity taint flows were detected, the unprotected AJAX endpoints remain the most prominent risk.