Loginer – Custom Login Page Builder Security & Risk Analysis

The 'loginer-custom-login-page-builder' plugin v1.4 exhibits a generally good security posture, with the exception of a single unprotected AJAX handler. The static analysis reveals a low attack surface consisting primarily of AJAX endpoints, and importantly, the single identified handler lacks authentication checks. This is a significant concern as it could allow unauthenticated users to trigger potentially sensitive actions. However, the plugin demonstrates strong practices in other areas. The absence of dangerous functions, the exclusive use of prepared statements for SQL queries, and a high percentage of properly escaped output are all positive indicators. Furthermore, the plugin has no recorded vulnerability history, suggesting a stable and secure development track record. The presence of nonce checks and capability checks on most entry points further bolsters its security. The bundled jQuery library is slightly outdated but not a critical concern given the lack of other detected vulnerabilities. Overall, while the plugin has a strong foundation, the unprotected AJAX handler represents a clear and present risk that requires immediate attention.