Click & Pledge – Paid Memberships Pro Security & Risk Analysis

The "click-pledge-paid-memberships-pro" plugin v25.12000000-WP6.9-PMP3.6.3 exhibits a concerning security posture due to a significant number of unprotected entry points. The static analysis reveals 8 AJAX handlers, all of which lack authentication checks, exposing a substantial attack surface to unauthenticated users. This is further compounded by the presence of the dangerous `unserialize` function, which can lead to remote code execution if improperly handled with untrusted input. While the plugin demonstrates good practices in SQL query preparation (95% prepared) and output escaping (92% escaped), the lack of basic security checks on AJAX endpoints and the potential risk from `unserialize` outweigh these strengths. The absence of any recorded vulnerabilities in its history might suggest a lack of widespread exploitation or an assumption of security, but it does not negate the risks identified in the code. The plugin's overall security is weakened by these identified weaknesses, requiring immediate attention.