Last Login Info Display Security & Risk Analysis

The plugin "last-login-info-display" v1.1.1 exhibits a generally good security posture with several strengths. Notably, it avoids dangerous functions, performs all SQL queries using prepared statements, and has a good rate of output escaping (81%). The absence of file operations and external HTTP requests further reduces potential attack vectors. Its vulnerability history is clean, with no recorded CVEs, indicating a potentially well-maintained and secure codebase.

However, a significant concern arises from the static analysis, which identified one AJAX handler that lacks authentication checks. This unprotected entry point represents a direct risk, as it could be exploited by unauthenticated users to trigger potentially unintended actions or reveal sensitive information. While taint analysis shows no critical or high-severity issues, and only a limited attack surface, this single unprotected AJAX handler is a clear vulnerability that needs immediate attention. The presence of a nonce check is positive, but its absence on this specific handler negates its protective effect for that entry point.

In conclusion, the plugin demonstrates solid coding practices in many areas, particularly regarding data handling and output sanitation. The clean vulnerability history is a strong positive signal. Nevertheless, the unprotected AJAX handler is a critical weakness that significantly lowers its overall security score and requires remediation.