LeadSnap Security & Risk Analysis

The leadsnap v1.25 plugin presents a significant security risk primarily due to its unprotected attack surface and historical vulnerability. The plugin exposes 12 AJAX handlers with no authentication or permission checks, meaning any user, including unauthenticated ones, can trigger these actions. This is a critical oversight. Furthermore, the presence of the `unserialize` function without apparent sanitization is a major concern, especially when combined with the fact that the plugin has a history of a critical deserialization vulnerability. While the plugin does utilize prepared statements for most of its SQL queries and has a decent output escaping rate, these strengths are overshadowed by the severe lack of input validation and authorization.