Limit Login Attempts Reloaded – Login Security, 2FA, Brute Force Protection & Firewall Security & Risk Analysis

The 'limit-login-attempts-reloaded' plugin v2.26.28 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and performing nonce checks on all its AJAX handlers. The lack of critical or high severity taint flows and no currently unpatched CVEs are also strong indicators of a generally secure recent state.

However, concerns arise from the presence of one AJAX handler without authentication checks, which represents a direct attack vector. While the static analysis did not reveal dangerous functions or raw SQL, the vulnerability history shows a pattern of past issues, including high and medium severity vulnerabilities, particularly related to missing authorization, excessive authentication attempts, and cross-site scripting. This history suggests a need for continued vigilance and a robust review process for future updates. The 70% proper output escaping, while not critically low, indicates room for improvement in preventing potential cross-site scripting vulnerabilities.

In conclusion, the plugin has strengths in its handling of SQL and AJAX nonces. Nevertheless, the single unprotected AJAX endpoint and the historical vulnerability data warrant attention. The plugin is not without risks, and ongoing monitoring and prompt patching of any newly discovered vulnerabilities will be crucial.