WPLMS MyCred AddOn Security & Risk Analysis

The "wplms-mycred-addon" v4.2 exhibits a mixed security posture. On the positive side, it demonstrates good practices by exclusively using prepared statements for all SQL queries and includes a reasonable number of nonce and capability checks. The absence of any known CVEs and bundled libraries is also a strength. However, significant concerns arise from the static analysis. The presence of one AJAX handler without authentication checks creates a direct attack vector. Furthermore, the taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for injection vulnerabilities, even though they are not classified as critical.