Authyo Passwordless Login Security & Risk Analysis

The 'authyo-passwordless-login' v1.0.3 plugin presents a mixed security posture. While it boasts no recorded vulnerabilities and a low number of external HTTP requests, the static analysis reveals several areas for concern. A significant portion of its attack surface, specifically 4 out of 9 AJAX handlers, lacks authentication checks. Additionally, both SQL queries within the plugin are not using prepared statements, which is a common vector for SQL injection vulnerabilities. The plugin also has a good output escaping rate at 84%, but this still leaves room for potential cross-site scripting (XSS) vulnerabilities in the remaining 16% of outputs. The absence of any taint analysis findings and a clean vulnerability history are positive indicators, suggesting that active exploitation of known issues is unlikely. However, the presence of unprotected entry points and raw SQL queries represent actionable risks that could be exploited by an attacker.