One area of vulnerability in WWF compared to the examples in the site above is that an attacker can easily acquire the entire source code and can know with near absolute certainty the name of every table and field.

 

Even if WWF were wide open to SQL Injection exploits, using SQL Injection alone, an attacker could not acquire a user password in order to act as that user.  Using SQL Injection and still assuming WWF were vulnerable, an attacker could change the user email address and then reset the password in order to act as that user after the reset.  Obviously the legitimate user could no longer log in with the old password and the email address would be a telltail sign of the attack.

 

 

 

WWF's security is so good, that I use it to power the login for my entire website.  Any other scripts I install, I modify to use WWF to handle members and login/logout.  Some of the other scripts I have purchased or downloaded from other people were vulnerable to that kind of attack, so modifying it to use WWF's member management made those scripts secure.