Login, Registration and Lost Password Blocks Security & Risk Analysis

The static analysis for the 'frontend-login-and-registration-blocks' plugin v1.2.1 reveals a mixed security posture. While the plugin demonstrates good practices by avoiding dangerous functions, using prepared statements for all SQL queries, and having a relatively clean output escaping rate (71%), there are concerning areas. The presence of 10 AJAX handlers with no apparent authentication checks is a significant weakness, creating a substantial attack surface. Furthermore, the vulnerability history is alarming, with two previously disclosed CVEs, including one critical and one high severity vulnerability, focusing on authorization bypass and unverified password changes. The fact that the last vulnerability was reported as recently as May 8, 2025, and is currently unpatched, is a major red flag.