Click & Pledge for Gravity Forms Security & Risk Analysis

The "gravity-forms-click-pledge" plugin exhibits a concerning security posture primarily due to its large, unprotected attack surface. With 31 AJAX handlers, 30 of which lack authentication checks, there's a significant risk of unauthorized access and execution of plugin functionalities. While the plugin demonstrates some good practices like using prepared statements for a majority of its SQL queries and having no known historical vulnerabilities, these are overshadowed by the identified code signals. The presence of the `unserialize` function, a known vulnerability vector, coupled with taint analysis revealing flows with unsanitized paths, raises alarms. Specifically, one high-severity flow indicates a potential for malicious data to be processed without adequate sanitization. The limited use of capability checks and nonces on entry points further exacerbates these risks. Despite a clean vulnerability history, the static analysis reveals latent issues that could be exploited if an attacker bypasses the limited security checks.