Invisible reCaptcha for WordPress Security & Risk Analysis

The static analysis of "invisible-recaptcha" v1.2.3 reveals a mixed security posture. While the plugin demonstrates good practices by having no exposed AJAX handlers, REST API routes, shortcodes, or cron events without proper authentication or permission checks, and no recorded historical vulnerabilities, there are significant concerns within its code signals. The presence of two instances of the dangerous `exec` function is a major red flag, as it can lead to remote code execution if not handled with extreme caution and proper sanitization. Furthermore, the fact that 100% of SQL queries are not using prepared statements is a serious vulnerability, increasing the risk of SQL injection attacks. The relatively low rate of properly escaped output (53%) also suggests potential for cross-site scripting (XSS) vulnerabilities. The lack of any taint analysis results could indicate either a very simple codebase or a limitation in the analysis tool's ability to detect complex data flows, but given the other signals, it should not be seen as confirmation of safety.