FluentAuth – The Ultimate Authorization & Security Plugin for WordPress Security & Risk Analysis

The "fluent-security" v2.1.1 plugin exhibits a mixed security posture. While it demonstrates good practices with a high percentage of prepared SQL statements and properly escaped output, significant concerns arise from its attack surface and vulnerability history. The presence of 4 AJAX handlers without authentication checks presents a considerable risk, as these could be exploited by unauthenticated users to perform unintended actions or expose sensitive information. The taint analysis, although showing no critical or high severity flows, did reveal 6 flows with unsanitized paths, indicating potential, albeit low-severity, vulnerabilities if not properly handled downstream. The plugin's vulnerability history shows 2 medium-severity CVEs, which, while currently patched, suggest a past susceptibility to certain types of attacks. The last vulnerability being in late 2025 is unusual and might indicate a data anomaly, but the pattern of medium severity issues warrants attention for future development. The plugin's strengths lie in its code hygiene regarding SQL and output, but the unprotected AJAX endpoints are a critical oversight that needs immediate remediation.