LoginPress | wp-login Custom Login Page Customizer Security & Risk Analysis

The LoginPress plugin, version 6.1.2, exhibits a mixed security posture. While it demonstrates good practices in several areas, such as a high percentage of SQL prepared statements and properly escaped output, there are significant concerns that lower its overall security. The presence of AJAX handlers without authentication checks directly exposes a part of the attack surface to potential unauthorized actions. Furthermore, the taint analysis revealing flows with unsanitized paths, although not critical or high severity in this specific analysis, indicates a potential for vulnerabilities if such paths are exploited. The plugin's history of six known CVEs, including high and medium severity vulnerabilities like CSRF, missing authorization, XSS, and SQL injection, is a major red flag. The fact that the last vulnerability was in early 2025 suggests a recurring pattern of security weaknesses despite efforts to patch. This history, coupled with the identified unprotected entry point, indicates a need for continued vigilance and development focus on robust security measures.