WP User Switch Security & Risk Analysis

The "wp-user-switch" plugin, despite its static analysis showing a seemingly low attack surface and good practices in terms of prepared statements and output escaping, presents significant security concerns due to its historical vulnerability data. The plugin has a history of 2 known CVEs, with one remaining unpatched. These past vulnerabilities, specifically 'Missing Authorization' and 'Authentication Bypass Using an Alternate Path or Channel', are critical indicators of potential weaknesses that could be exploited again. The fact that these types of vulnerabilities have occurred previously suggests potential systemic issues in how user roles and permissions are handled within the plugin. While the code signals like nonce and capability checks are present, their effectiveness is undermined by the past exploits that bypassed them. Therefore, the presence of an unpatched high-severity vulnerability and the recurring nature of critical vulnerability types should be a major red flag for users.