click5 CRM add-on to Contact Form 7 Security & Risk Analysis

The plugin "cf7-add-on-by-click5" v1.0.4 exhibits a significant security concern due to its entirely unprotected REST API entry points. With 9 REST API routes, all lacking permission callbacks, an attacker could potentially interact with these endpoints without any authentication or authorization checks. This creates a wide attack surface that could be exploited to manipulate plugin functionality or access sensitive data. While the plugin demonstrates good practices in other areas, such as using prepared statements for all SQL queries and having no recorded vulnerabilities, the unprotected REST API endpoints represent a critical weakness that needs immediate attention. The absence of taint analysis results and a lack of known CVEs are positive indicators, but they do not negate the risk posed by the exposed REST API.