WP-WebAuthn Security & Risk Analysis

The wp-webauthn plugin, in version 1.4.1, exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to fundamental WordPress security practices, with all identified entry points (AJAX handlers, REST API routes, shortcodes, and cron events) appearing to have appropriate authentication and authorization checks. SQL queries are exclusively handled via prepared statements, and output escaping is generally robust, with only a small percentage showing potential for issues. Furthermore, the absence of external HTTP requests and the use of capability checks on a significant portion of its code are commendable.

However, several critical concerns warrant attention. The static analysis reveals a notable number of 'dangerous functions' being utilized, including those capable of executing arbitrary code on the server. More alarmingly, the taint analysis identified six high-severity flows with unsanitized paths. This suggests that user-supplied input could be improperly handled, leading to potential vulnerabilities if not meticulously sanitized before being used in sensitive operations, especially in conjunction with the identified dangerous functions. The vulnerability history, while not detailing critical or high severity CVEs in the past, indicates a pattern of medium-severity Cross-Site Scripting (XSS) vulnerabilities. The presence of a recent, unpatched medium vulnerability (as of 2026-03-20) is a significant red flag, suggesting potential ongoing issues with input validation or output encoding in specific scenarios.

In conclusion, while wp-webauthn implements several key security best practices, the presence of dangerous functions, high-severity unsanitized taint flows, and a history of XSS vulnerabilities, compounded by an unpatched medium CVE, indicates a substantial risk. The plugin requires immediate attention to address the identified taint flows and the unpatched vulnerability. Further in-depth review of the usage of dangerous functions in conjunction with user input is also strongly recommended.