Melapress Login Security Security & Risk Analysis

The melapress-login-security plugin v2.3.0 presents a mixed security posture. On the positive side, the plugin demonstrates good practices regarding SQL query sanitization, utilizing prepared statements for all queries and a high percentage of properly escaped output. The presence of numerous nonce and capability checks also suggests an effort to secure certain functionalities. However, significant concerns arise from the substantial attack surface, particularly the 14 AJAX handlers, with 11 of them lacking authentication checks. This directly exposes a large portion of the plugin's functionality to unauthorized access.

The vulnerability history of this plugin is a major red flag. With four known CVEs, including one critical and one high severity, and common vulnerability types such as Authentication Bypass, Deserialization of Untrusted Data, and PHP Remote File Inclusion, it indicates a recurring pattern of security weaknesses. The fact that the last vulnerability was very recent (2025-07-25) and is listed as 'currently unpatched' (though the data states 0 unpatched, this is a contradiction that needs clarification, assuming the last vulnerability reported is indeed a real issue and the 'unpatched' count is an error) is highly concerning, suggesting that attackers may have exploitable vulnerabilities available.

While the taint analysis shows no critical or high severity unsanitized paths in the current version, the past vulnerability patterns and the substantial unprotected attack surface are strong indicators of potential future risks. The presence of `unserialize` without immediate context on its usage is also a point of caution, especially given the plugin's history with deserialization vulnerabilities. In conclusion, while the plugin has some good security implementations, the combination of a large unprotected attack surface and a history of severe vulnerabilities warrants significant caution.