WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) Security & Risk Analysis

The wpo365-login plugin exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation and output escaping, with high percentages of both, it has a significant concern regarding its attack surface. A large number of AJAX handlers (35) are unprotected by authentication checks, presenting a substantial entry point for attackers. The taint analysis revealed a small number of flows with unsanitized paths, though thankfully none reached critical or high severity levels.

The plugin's vulnerability history is a notable weakness. With four known CVEs, including one previously classified as critical and three as medium, it indicates a pattern of past security flaws. The common vulnerability types (SSRF, XSS, Improper Authentication) are serious and often exploitable. The fact that there are currently no unpatched vulnerabilities is positive, but the historical prevalence of these issues warrants caution. The last recorded vulnerability date, 2026-01-21, seems to be in the future, which may indicate a data error or that this is a projection.

Overall, the plugin has strengths in secure coding practices for SQL and output handling. However, the unprotected AJAX endpoints and the history of critical and medium severity vulnerabilities, particularly those related to SSRF, XSS, and improper authentication, significantly elevate the risk. Users should exercise caution and ensure the plugin is always updated to the latest version to mitigate known risks.