WPOrLogin – Custom Login, Social Login, Limit Attempts, Hide Login & reCAPTCHA Security & Risk Analysis

The "wporlogin" v3.0.2 plugin presents a mixed security posture. While it demonstrates some good practices like a high percentage of prepared SQL statements and proper output escaping, it also has significant security concerns. The plugin exposes two AJAX handlers without authentication checks, creating a considerable attack surface for unauthorized actions. Furthermore, taint analysis revealed flows with unsanitized paths, including one of high severity, indicating potential for injection vulnerabilities that could be exploited if data is not properly validated.

The plugin's vulnerability history is clean, with no recorded CVEs. This suggests that in the past, it has not been a target or has been developed with a high level of security awareness. However, the current static analysis findings, particularly the unprotected AJAX endpoints and the high-severity taint flow, indicate that the current version has introduced new risks. The absence of past vulnerabilities should not lead to complacency, as the present code analysis highlights areas needing immediate attention.

In conclusion, "wporlogin" v3.0.2 has a concerning number of unprotected entry points and a high-severity taint flow, outweighing its strengths in SQL prepared statements and output escaping. The clean vulnerability history is a positive sign but does not mitigate the immediate risks identified in the code. It is recommended that the unprotected AJAX handlers be secured with appropriate authentication and capability checks, and the identified unsanitized path flow be thoroughly investigated and remediated.