User Last Visit Security & Risk Analysis

The "user-last-visit" v1.0 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, not executing raw SQL queries, and not making external HTTP requests. The presence of nonce checks and a lack of reported historical vulnerabilities suggest a developer who is at least somewhat security-aware. However, significant concerns arise from the attack surface analysis. A single AJAX handler is present and lacks any authentication checks, presenting a direct pathway for unauthorized actions. Furthermore, the taint analysis indicates flows with unsanitized paths, although no critical or high severity issues were identified in this specific analysis, the presence of such flows coupled with unprotected entry points is worrying. The plugin's current state, with its unprotected AJAX endpoint and unsanitized path flows, requires immediate attention despite the absence of known CVEs.