WP User Profiles Security & Risk Analysis

The wp-user-profiles plugin v2.6.2 exhibits a mixed security posture. On the positive side, the code demonstrates strong adherence to secure coding practices by exclusively using prepared statements for SQL queries and having a high percentage of properly escaped output. Furthermore, it performs a reasonable number of capability checks and includes nonce checks for its entry points. However, significant security concerns arise from the attack surface. All three identified AJAX handlers lack authentication checks, presenting a direct pathway for unauthorized actions. The single external HTTP request is also a potential area for vulnerability if not properly handled. The plugin's vulnerability history, specifically a high-severity, unpatched CVE related to Improper Privilege Management, is a critical red flag that overshadows the positive coding practices. This suggests a recurring pattern of security weaknesses that have not been fully addressed, increasing the risk of exploitation.