WP Activity Log Security & Risk Analysis

The wp-security-audit-log plugin version 5.6.1 exhibits a mixed security posture. On the positive side, it demonstrates good practices in SQL query handling with 85% using prepared statements and a high percentage of properly escaped outputs. The presence of numerous nonce and capability checks also indicates an effort towards securing its functionalities. However, significant concerns arise from the substantial attack surface, particularly the 13 unprotected AJAX handlers, which present a prime target for unauthorized actions. The identified taint flow with high severity and unsanitized paths, coupled with the use of the `unserialize` function, points to potential vulnerabilities like deserialization attacks and cross-site scripting. The plugin's history of 11 known CVEs, including past critical and high-severity issues, although none are currently unpatched, suggests a pattern of past exploitable weaknesses that require diligent maintenance and timely updates. The last vulnerability in 2026 suggests the data may be from the future or an error, but the sheer volume and types of past vulnerabilities are concerning.