Keyless Auth – Login without Passwords Security & Risk Analysis

The "keyless-auth" plugin version 3.2.4 demonstrates a strong security posture with several good practices. All identified entry points, including AJAX handlers, REST API routes, shortcodes, and cron events, appear to have authentication checks in place, which is a significant strength. Furthermore, the plugin exhibits excellent output escaping practices and avoids dangerous functions, file operations, and external HTTP requests. The use of prepared statements for SQL queries is also a positive indicator, although room for improvement exists given the percentage. The vulnerability history is clean, with no known CVEs, which suggests a history of secure development or prompt patching.

However, the taint analysis reveals some concerns. The presence of 9 flows with unsanitized paths, even if not classified as critical, warrants attention. These flows represent potential injection vulnerabilities where untrusted data could be manipulated. While the plugin has a substantial number of nonce checks and capability checks, the taint analysis suggests that some of these might not be effectively preventing the identified unsanitized paths. The relatively high percentage of SQL queries not using prepared statements also presents a moderate risk of SQL injection, especially if those queries handle user-supplied data.

In conclusion, "keyless-auth" v3.2.4 is a generally well-secured plugin with robust authentication and output sanitization. The lack of historical vulnerabilities is encouraging. The primary areas for improvement lie in addressing the identified unsanitized paths from the taint analysis and increasing the utilization of prepared statements for all SQL queries to further harden the plugin against potential injection attacks.