Login as User or Customer — User Switching Security & Risk Analysis

The "login-as-customer-or-user" v3.9.1 plugin presents a mixed security posture. While the static analysis indicates a relatively small attack surface with no unprotected entry points and a strong adherence to prepared statements for SQL queries, the plugin's history is a significant concern. The presence of 5 known CVEs, with 2 critically severe and unpatched vulnerabilities, suggests a pattern of recurring security flaws. These historical issues, including authentication bypass, improper authentication/authorization, and CSRF, highlight potential weaknesses in how the plugin handles user access and session management. Despite the current static analysis showing no critical taint flows and good output escaping, the past vulnerability record indicates that these aspects may have been compromised in previous versions, and the current version might still harbor latent risks or be susceptible to similar attack vectors.