AWEOS Admin Login Security & Risk Analysis

The "aweos-admin-login" plugin, version 1.5.13, presents a significant security risk primarily due to its unprotected entry points. The static analysis reveals four AJAX handlers that lack any authentication or capability checks. This means any user, even unauthenticated ones, could potentially interact with these handlers, leading to unintended actions or information disclosure if the underlying code is vulnerable. While the plugin demonstrates good practices in SQL query handling and has no recorded vulnerability history, the absence of basic security measures on its AJAX endpoints is a critical oversight. The taint analysis indicates potential issues with unsanitized paths, which, combined with the unprotected AJAX handlers, could be exploited for path traversal or arbitrary file read/write vulnerabilities. The lack of nonce checks on these handlers further exacerbates this risk.