Get User Info Security & Risk Analysis

The "get-user-info" plugin version 1.2 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by utilizing prepared statements for all SQL queries and has no recorded vulnerability history, indicating a potentially stable and well-maintained codebase. The attack surface is minimal, with only one shortcode identified as an entry point, and crucially, no unauthenticated entry points were found. This suggests a deliberate effort to limit exposure.

However, there are significant concerns within the static analysis. The presence of the `create_function` dangerous function is a critical red flag, as it is a known source of security vulnerabilities, particularly when user input is involved, although taint analysis currently shows no unsanitized flows. Furthermore, the output escaping is very poor, with only 15% of outputs properly escaped, creating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The complete absence of nonce checks and capability checks, even for the identified shortcode, is a major oversight that leaves the plugin susceptible to various attacks if any part of its functionality can be triggered by external input.