Open User Map Security & Risk Analysis

The open-user-map plugin v1.4.34 presents a mixed security posture. While it demonstrates some good practices, such as a high percentage of SQL queries using prepared statements and a decent number of capability checks, significant concerns arise from the static analysis. The presence of 14 AJAX handlers, with 3 lacking authentication checks, creates a substantial attack surface that could be exploited without proper user authorization. Furthermore, the taint analysis reveals 4 flows with unsanitized paths, although thankfully none are flagged as critical or high severity, this still represents a potential risk of path traversal vulnerabilities if these flows are not properly handled in conjunction with other security controls. The plugin's vulnerability history shows 3 medium-severity CVEs, specifically related to Path Traversal and Cross-site Scripting. While there are currently no unpatched CVEs, the recurring nature of these vulnerability types suggests a potential weakness in input sanitization and output escaping that needs ongoing vigilance and remediation. The last reported vulnerability in 2026 is also an anomaly that requires further investigation, but assuming it represents a historical event, the recurring nature of past issues is the primary concern.