OTP Login With Phone Number, OTP Verification Security & Risk Analysis

The 'login-with-phone-number' plugin, version 1.8.61, presents a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a relatively high percentage of properly escaped output, significant concerns exist regarding its attack surface and historical vulnerability profile.

The static analysis reveals a large number of AJAX handlers (26) that lack authentication checks, creating a substantial unprotected attack surface. This is a critical weakness as it could allow unauthenticated users to trigger potentially sensitive actions. Taint analysis did not reveal any immediate vulnerabilities, which is positive, but the lack of flows analyzed or unsanitized paths might indicate limited depth in the analysis or a lack of complex data handling that could be exploited.

The plugin's vulnerability history is alarming, with a total of 13 known CVEs, including one critical and five high-severity vulnerabilities. The variety of past vulnerability types, such as improper privilege management, XSS, authentication bypass, and CSRF, indicates recurring security flaws. The fact that all previous vulnerabilities are listed as patched (zero currently unpatched) is a mitigating factor, but the sheer volume and nature of past issues suggest a pattern of weak security implementation that requires ongoing vigilance. The most recent vulnerability being in the past is also a positive sign. Overall, the plugin has areas of strength but the extensive unprotected entry points and a history of severe vulnerabilities necessitate caution.