EDD Purchase Rewards Security & Risk Analysis

The 'edd-purchase-rewards' plugin v1.1 exhibits a mixed security posture. While it demonstrates good practices by utilizing prepared statements for all SQL queries and performing no external HTTP requests, several significant security concerns are present. The static analysis reveals two AJAX handlers, both of which lack authentication checks. This is a critical weakness as it exposes potential entry points for malicious actors to trigger plugin functionality without proper authorization. Furthermore, the plugin has a low percentage of properly escaped output, indicating a risk of Cross-Site Scripting (XSS) vulnerabilities. The absence of any recorded vulnerabilities in its history is a positive sign, suggesting a lack of previously discovered flaws. However, this history does not mitigate the current risks identified in the static analysis. The unprotected AJAX handlers and the low output escaping coverage present an immediate and actionable threat that needs to be addressed.