Wbcom Designs – Private Community for BuddyPress Security & Risk Analysis

The lock-my-bp v2.1.2 plugin exhibits a mixed security posture. While it demonstrates good practices by avoiding dangerous functions, file operations, and external HTTP requests, and by using prepared statements for a majority of its SQL queries, significant concerns remain regarding its attack surface. The presence of four unprotected AJAX handlers represents a considerable risk, as these are direct entry points that lack necessary authentication and authorization checks, potentially allowing unauthorized users to trigger plugin functionalities. The plugin's history of two medium-severity vulnerabilities, both related to missing authorization, further amplifies this concern and suggests a pattern of overlooking proper access control in its development. Although there are no currently unpatched CVEs and a decent percentage of output is properly escaped, the lack of robust authorization on critical entry points is a fundamental security flaw that needs immediate attention.