Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress Security & Risk Analysis

The "login-me-now" v1.14 plugin presents a mixed security posture. On the positive side, it demonstrates good practices with a high percentage of SQL queries using prepared statements and a significant portion of outputs being properly escaped. The presence of numerous nonce and capability checks indicates an effort to secure its entry points. However, the static analysis reveals specific areas of concern, notably the use of the `unserialize` function, which is inherently risky and can lead to remote code execution if not handled with extreme care. Furthermore, the taint analysis identified four high-severity flows with unsanitized paths, suggesting potential vulnerabilities that could be exploited by attackers to manipulate application behavior or gain unauthorized access. The plugin's vulnerability history, with a past high-severity CVE related to Authentication Bypass Using an Alternate Path or Channel, reinforces the importance of scrutinizing its input validation and access control mechanisms.