WP User Manager – User Profile Builder & Membership Security & Risk Analysis

The wp-user-manager plugin v2.9.15 exhibits a mixed security posture. While it demonstrates good practices in areas like prepared SQL statements (69%) and output escaping (88%), significant concerns arise from its attack surface and vulnerability history. The presence of 8 unprotected AJAX handlers is a primary risk, as these can be leveraged for unauthorized actions without proper authentication checks. The taint analysis further highlights issues with 4 high-severity flows involving unsanitized paths, indicating potential for path traversal or arbitrary file access vulnerabilities.

The plugin's history of 7 known CVEs, including 2 high-severity ones, with common types like missing authorization and deserialization, suggests a recurring pattern of exploitable weaknesses. The fact that the last vulnerability was recorded in December 2025 (though this may be a future date and should be verified) implies ongoing security challenges. While there are no currently unpatched CVEs, the historical prevalence of critical and high-severity issues, coupled with specific code-level concerns like unprotected AJAX endpoints and high-severity taint flows, warrants caution.

In conclusion, while the plugin shows some strengths in code hygiene, the identified unprotected entry points, critical taint flows, and a history of significant vulnerabilities point to a moderate to high-risk profile. Users should exercise caution and ensure this plugin is thoroughly audited and updated, especially given the identified areas of concern.