WPSS Ultimate User Management Security & Risk Analysis

The "wpss-ultimate-user-management" plugin v1.1.2 presents a significant security risk due to its exposed attack surface. While the plugin demonstrates good practices in preventing common vulnerabilities like raw SQL queries and largely adheres to output escaping, the presence of 20 unprotected AJAX handlers is a critical concern. This means any unauthenticated user can potentially trigger these actions, leading to unintended consequences or exploitation. The plugin's vulnerability history is clean, which is a positive indicator, suggesting the developers have historically been diligent. However, this clean history, combined with the current unprotected AJAX endpoints, could indicate a lack of comprehensive security testing or a focus on newer code paths that may have been overlooked. The limited number of nonce and capability checks, despite the large number of AJAX handlers, further exacerbates the risk.