Credly Login Security & Risk Analysis

The Credly Login plugin exhibits a significantly concerning security posture due to its unprotected attack surface. With all four identified AJAX handlers lacking authentication checks, this plugin presents a high risk of unauthorized access and manipulation by unauthenticated users. While the plugin utilizes prepared statements for its SQL queries, mitigating SQL injection risks in that area, the general lack of capability checks and nonce verifications on its entry points is a major oversight. The presence of the `create_function` call, though flagged as a dangerous function, is a singular concern and not immediately indicative of a severe exploit unless it's used in a vulnerable context, which is not explicitly detailed by the static analysis. The absence of any recorded vulnerability history is positive but does not negate the immediate, high-risk findings from the code analysis.