Leat Security & Risk Analysis

wordpress.org/plugins/leat-crm

Create and manage customer loyalty programs with points, rewards, and automated marketing - works both online and in-store.

10 active installs v3.4.1 PHP 7.4+ WP 5.0+ Updated Mar 13, 2026
loyaltyloyalty-programmarketing-automationrewardsvouchers
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Leat Safe to Use in 2026?

Generally Safe

Score 100/100

Leat has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 21d ago
Risk Assessment

The 'leat-crm' plugin version 3.4.1 exhibits a generally good security posture with strong adherence to secure coding practices. The vast majority of SQL queries utilize prepared statements, and output escaping is robust, with 96% of outputs properly handled. The plugin also demonstrates a good number of capability checks and nonce checks, which are crucial for preventing unauthorized actions. The absence of any recorded vulnerabilities or CVEs in its history further suggests a stable and well-maintained codebase.

However, there are a few areas that warrant attention. The presence of two instances of the `unserialize` function is a potential concern, as unsanitized serialized data can lead to arbitrary code execution vulnerabilities. While no critical or high severity taint flows were detected, this function remains a known risk factor. Additionally, the plugin exposes 38 REST API routes, with one lacking proper permission callbacks. This single unprotected REST API route represents a significant attack vector that could potentially be exploited to gain unauthorized access or perform actions within the plugin's scope.

Despite these minor concerns, the overall security profile of 'leat-crm' v3.4.1 appears to be strong. The developer's commitment to secure coding practices, as evidenced by the high percentage of prepared SQL statements and properly escaped output, is commendable. The absence of historical vulnerabilities is a positive indicator. The primary areas for improvement are addressing the `unserialize` usage and ensuring all REST API endpoints have appropriate permission checks implemented.

Key Concerns

  • REST API route without permission callbacks
  • Dangerous function: unserialize usage
Vulnerabilities
None known

Leat Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 17, 2026

Leat Code Analysis

Dangerous Functions
2
Raw SQL Queries
6
24 prepared
Unescaped Output
21
531 escaped
Nonce Checks
17
Capability Checks
23
File Operations
9
External Requests
1
Bundled Libraries
1

Dangerous Functions Found

unserialize$unserialized = @unserialize( $gift_cards );src\Application\Services\GiftcardManager.php:1022
unserializereturn @unserialize($data, $options); // @phpcs:ignoresrc\Utils\BackgroundProcess.php:982

Bundled Libraries

Guzzle

SQL Query Safety

80% prepared30 total queries

Output Escaping

96% escaped552 total outputs
Data Flows
All sanitized

Data Flow Analysis

2 flows
<GiftcardManager> (src\Application\Services\GiftcardManager.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

Leat Attack Surface

Entry Points49
Unprotected1

AJAX Handlers 10

authwp_ajax_leat_reset_settingssrc\Admin\DebugToolbar.php:71
authwp_ajax_leat_sync_single_productsrc\Admin\ProductActions.php:76
authwp_ajax_woocommerce_refund_line_itemssrc\Application\Services\GiftcardManager.php:112
authwp_ajax_leat_add_gift_card_to_sessionsrc\Application\Services\GiftcardManager.php:136
noprivwp_ajax_leat_add_gift_card_to_sessionsrc\Application\Services\GiftcardManager.php:137
authwp_ajax_leat_remove_gift_card_from_sessionsrc\Application\Services\GiftcardManager.php:138
noprivwp_ajax_leat_remove_gift_card_from_sessionsrc\Application\Services\GiftcardManager.php:139
authwp_ajax_leat_get_applied_gift_cardssrc\Application\Services\GiftcardManager.php:142
noprivwp_ajax_leat_get_applied_gift_cardssrc\Application\Services\GiftcardManager.php:143
authwp_ajax_leat_flush_rewrite_rulessrc\Infrastructure\Services\WooCommerceAccountTab.php:64

REST API Routes 38

GET/wp-json/leat/v1/contactsrc\Rest\ContactEndpoint.php:95
GET/wp-json/leat/v1/join-programsrc\Rest\ContactEndpoint.php:129
GET/wp-json/leat/v1/apply-couponsrc\Rest\CouponsEndpoint.php:105
GET/wp-json/leat/v1/couponssrc\Rest\CouponsEndpoint.php:127
GET/wp-json/leat/v1/admin/earn-rulessrc\Rest\EarnRulesEndpoint.php:109
GET/wp-json/leat/v1/earn-rulessrc\Rest\EarnRulesEndpoint.php:133
GET/wp-json/leat/v1/admin/earn-rulessrc\Rest\EarnRulesEndpoint.php:167
GET/wp-json/leat/v1/earn-rewardsrc\Rest\EarnRulesEndpoint.php:264
POST/wp-json/leat/v1/enrollsrc\Rest\EnrollmentEndpoint.php:52
GET/wp-json/leat/v1/giftcardssrc\Rest\GiftcardsEndpoint.php:85
GET/wp-json/leat/v1/giftcards/session/addsrc\Rest\GiftcardSessionEndpoint.php:83
GET/wp-json/leat/v1/giftcards/session/removesrc\Rest\GiftcardSessionEndpoint.php:101
GET/wp-json/leat/v1/giftcards/sessionsrc\Rest\GiftcardSessionEndpoint.php:119
GET/wp-json/leat/v1/giftcards/checksrc\Rest\GiftcardSessionEndpoint.php:130
GET/wp-json/leat/v1/points/calculatesrc\Rest\PointsCalculationEndpoint.php:88
GET/wp-json/leat/v1/points/calculate-productsrc\Rest\PointsCalculationEndpoint.php:106
GET/wp-json/leat/v1/admin/promotion-rulessrc\Rest\PromotionRulesEndpoint.php:85
GET/wp-json/leat/v1/promotion-rulessrc\Rest\PromotionRulesEndpoint.php:109
GET/wp-json/leat/v1/admin/promotion-rulessrc\Rest\PromotionRulesEndpoint.php:138
GET/wp-json/leat/v1/promotion-couponssrc\Rest\PromotionRulesEndpoint.php:150
GET/wp-json/leat/v1/settingssrc\Rest\SettingsEndpoint.php:86
GET/wp-json/leat/v1/settingssrc\Rest\SettingsEndpoint.php:103
GET/wp-json/leat/v1/shopssrc\Rest\ShopsEndpoint.php:73
GET/wp-json/leat/v1/admin/spend-rulessrc\Rest\SpendRulesEndpoint.php:106
GET/wp-json/leat/v1/spend-rulessrc\Rest\SpendRulesEndpoint.php:130
GET/wp-json/leat/v1/spend-rulessrc\Rest\SpendRulesEndpoint.php:169
GET/wp-json/leat/v1/spend-rules/(?P<id>\d+)/redeemsrc\Rest\SpendRulesEndpoint.php:197
GET/wp-json/leat/v1/admin/spend-rulessrc\Rest\SpendRulesEndpoint.php:227
GET/wp-json/leat/v1/admin/syncsrc\Rest\SyncEndpoint.php:106
GET/wp-json/leat/v1/admin/syncsrc\Rest\SyncEndpoint.php:126
GET/wp-json/leat/v1/tierssrc\Rest\TiersEndpoint.php:72
GET/wp-json/leat/v1/wc-categoriessrc\Rest\WCCategoriesSearchEndpoint.php:60
GET/wp-json/leat/v1/wc-categoriessrc\Rest\WCCategoriesSearchEndpoint.php:79
GET/wp-json/leat/v1/wc-productssrc\Rest\WCProductsSearchEndpoint.php:60
GET/wp-json/leat/v1/wc-productssrc\Rest\WCProductsSearchEndpoint.php:79
GET/wp-json/leat/private/webhookssrc\Rest\WebhooksEndpoint.php:68
GET/wp-json/leat/v1/admin/webhookssrc\Rest\WebhooksEndpoint.php:79
GET/wp-json/leat/v1/admin/webhookssrc\Rest\WebhooksEndpoint.php:90

Shortcodes 1

[leat_content_block] src\Infrastructure\Services\ContentBlockRenderer.php:99
WordPress Hooks 169
actionadmin_noticesleat-crm.php:29
actionbefore_woocommerce_initleat-crm.php:87
actionplugins_loadedleat-crm.php:117
actioninitleat-crm.php:123
actionadmin_menusrc\Admin\Admin.php:72
actionadmin_enqueue_scriptssrc\Admin\Admin.php:73
actionadmin_headsrc\Admin\Admin.php:74
filteruse_block_editor_for_postsrc\Admin\Admin.php:77
filtergutenberg_can_edit_postsrc\Admin\Admin.php:78
actionwp_footersrc\Admin\DebugToolbar.php:67
actionadmin_footersrc\Admin\DebugToolbar.php:68
actionwp_enqueue_scriptssrc\Admin\DebugToolbar.php:69
actionadmin_enqueue_scriptssrc\Admin\DebugToolbar.php:70
actionadmin_enqueue_scriptssrc\Admin\GlobalAdminScript.php:44
actionadmin_menusrc\Admin\LogsPage.php:23
actionadmin_post_leat_clear_logssrc\Admin\LogsPage.php:24
filterpost_row_actionssrc\Admin\ProductActions.php:67
filterbulk_actions-edit-productsrc\Admin\ProductActions.php:70
filterhandle_bulk_actions-edit-productsrc\Admin\ProductActions.php:73
actionadmin_enqueue_scriptssrc\Admin\ProductActions.php:79
actionadmin_noticessrc\Admin\ProductActions.php:82
actionwoocommerce_review_order_before_submitsrc\Application\Services\CheckoutOptInService.php:78
actionwoocommerce_checkout_update_order_metasrc\Application\Services\CheckoutOptInService.php:81
actionwoocommerce_store_api_checkout_update_order_metasrc\Application\Services\CheckoutOptInService.php:85
actionprofile_updatesrc\Application\Services\CustomerAttributeSync.php:51
actionwp_loginsrc\Application\Services\CustomerAttributeSync.php:52
actionwp_logoutsrc\Application\Services\CustomerAttributeSync.php:53
actionwoocommerce_after_calculate_totalssrc\Application\Services\GiftcardManager.php:86
actionwoocommerce_cart_loaded_from_sessionsrc\Application\Services\GiftcardManager.php:87
actionwoocommerce_checkout_create_ordersrc\Application\Services\GiftcardManager.php:88
actionwoocommerce_order_after_calculate_totalssrc\Application\Services\GiftcardManager.php:89
actionwoocommerce_blocks_loadedsrc\Application\Services\GiftcardManager.php:93
actionwoocommerce_checkout_order_processedsrc\Application\Services\GiftcardManager.php:101
actionwoocommerce_review_order_before_paymentsrc\Application\Services\GiftcardManager.php:104
actionwoocommerce_cart_totals_before_order_totalsrc\Application\Services\GiftcardManager.php:106
actionwoocommerce_review_order_before_order_totalsrc\Application\Services\GiftcardManager.php:107
filterwoocommerce_get_order_item_totalssrc\Application\Services\GiftcardManager.php:108
actionwoocommerce_order_refundedsrc\Application\Services\GiftcardManager.php:111
actionwoocommerce_admin_order_totals_after_taxsrc\Application\Services\GiftcardManager.php:115
actionwoocommerce_admin_order_totals_after_totalsrc\Application\Services\GiftcardManager.php:116
actionadd_meta_boxessrc\Application\Services\GiftcardManager.php:117
filtermanage_edit-shop_order_columnssrc\Application\Services\GiftcardManager.php:120
actionmanage_shop_order_posts_custom_columnsrc\Application\Services\GiftcardManager.php:121
filtermanage_woocommerce_page_wc-orders_columnssrc\Application\Services\GiftcardManager.php:124
actionmanage_woocommerce_page_wc-orders_custom_columnsrc\Application\Services\GiftcardManager.php:125
actionwoocommerce_checkout_order_processedsrc\Application\Services\GiftcardManager.php:128
actionwoocommerce_cart_emptiedsrc\Application\Services\GiftcardManager.php:129
actionwoocommerce_checkout_processsrc\Application\Services\GiftcardManager.php:130
actionwp_enqueue_scriptssrc\Application\Services\GiftcardManager.php:133
filterwoocommerce_product_data_tabssrc\Application\Services\GiftcardProductService.php:92
actionwoocommerce_product_data_panelssrc\Application\Services\GiftcardProductService.php:93
actionwoocommerce_process_product_metasrc\Application\Services\GiftcardProductService.php:94
filterwoocommerce_order_item_display_meta_valuesrc\Application\Services\GiftcardProductService.php:95
actionwoocommerce_before_order_notessrc\Application\Services\GiftcardProductService.php:103
actionwoocommerce_checkout_update_order_metasrc\Application\Services\GiftcardProductService.php:104
actionwoocommerce_checkout_processsrc\Application\Services\GiftcardProductService.php:105
actionwoocommerce_store_api_checkout_update_order_metasrc\Application\Services\GiftcardProductService.php:108
actionwoocommerce_order_item_add_action_buttonssrc\Application\Services\GiftcardProductService.php:115
actionwoocommerce_order_refundedsrc\Application\Services\GiftcardProductService.php:121
actionuser_registersrc\Application\Services\NewCustomerService.php:59
actionwoocommerce_created_customersrc\Application\Services\NewCustomerService.php:60
actionxoo_el_user_createdsrc\Application\Services\NewCustomerService.php:67
actionxoo_el_after_user_registersrc\Application\Services\NewCustomerService.php:68
actionxoo_el_registration_fields_savesrc\Application\Services\NewCustomerService.php:69
actionleat_delayed_contact_syncsrc\Application\Services\NewCustomerService.php:75
actionwoocommerce_order_status_on-holdsrc\Application\Services\OrderProcessor.php:138
actionwoocommerce_order_status_processingsrc\Application\Services\OrderProcessor.php:141
actioninitsrc\Application\Services\OrderProcessor.php:144
actionwoocommerce_checkout_order_processedsrc\Application\Services\OrderProcessor.php:147
actionwoocommerce_rest_checkout_process_payment_with_contextsrc\Application\Services\OrderProcessor.php:148
actionwoocommerce_checkout_order_createdsrc\Application\Services\PrepaidProductService.php:93
actionwoocommerce_order_refundedsrc\Application\Services\PrepaidProductService.php:112
actionwoocommerce_variation_options_pricingsrc\Application\Services\PrepaidProductService.php:122
actionwoocommerce_save_product_variationsrc\Application\Services\PrepaidProductService.php:123
actionwoocommerce_product_options_general_product_datasrc\Application\Services\PrepaidProductService.php:126
actionwoocommerce_process_product_metasrc\Application\Services\PrepaidProductService.php:127
actionwoocommerce_order_refundedsrc\Application\Services\ReturnHandler.php:63
actionwoocommerce_order_partially_refundedsrc\Application\Services\ReturnHandler.php:64
actionleat_run_promotions_syncsrc\Application\Services\Syncing\PromotionsSync.php:65
actionleat_run_spend_rules_syncsrc\Application\Services\Syncing\RewardsSync.php:71
actionleat_run_vouchers_syncsrc\Application\Services\Syncing\VouchersSync.php:98
filterwoocommerce_product_data_tabssrc\Application\Services\VoucherProductService.php:116
actionwoocommerce_product_data_panelssrc\Application\Services\VoucherProductService.php:117
actionwoocommerce_process_product_metasrc\Application\Services\VoucherProductService.php:118
filterwoocommerce_order_item_display_meta_valuesrc\Application\Services\VoucherProductService.php:119
actionwoocommerce_order_item_meta_endsrc\Application\Services\VoucherProductService.php:126
actionwoocommerce_order_item_add_action_buttonssrc\Application\Services\VoucherProductService.php:129
actionwoocommerce_order_refundedsrc\Application\Services\VoucherProductService.php:136
actionwp_enqueue_scriptssrc\Frontend\Frontend.php:41
filterwoocommerce_registration_redirectsrc\Frontend\Frontend.php:42
actioninitsrc\Infrastructure\Blocks\AbstractBlock.php:49
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\AbstractWooCommerceBlockIntegration.php:32
actionenqueue_block_assetssrc\Infrastructure\Blocks\AbstractWooCommerceBlockIntegration.php:33
actionwoocommerce_blocks_loadedsrc\Infrastructure\Blocks\BlockRegistry.php:197
actioninitsrc\Infrastructure\Blocks\BlockRegistry.php:199
actioninitsrc\Infrastructure\Blocks\BlockRegistry.php:201
filterblock_categories_allsrc\Infrastructure\Blocks\BlocksManager.php:21
actioninitsrc\Infrastructure\Blocks\CouponsListBlock.php:62
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\CouponsListBlock.php:63
actioninitsrc\Infrastructure\Blocks\EarnRulesListBlock.php:60
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\EarnRulesListBlock.php:61
actioninitsrc\Infrastructure\Blocks\JoinProgramButton.php:54
actioninitsrc\Infrastructure\Blocks\LoyaltyHeading.php:66
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\LoyaltyHeading.php:67
actioninitsrc\Infrastructure\Blocks\LoyaltyParagraph.php:56
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\LoyaltyParagraph.php:57
actionenqueue_block_editor_assetssrc\Infrastructure\Blocks\LoyaltyPreviewSidebar.php:36
actioninitsrc\Infrastructure\Blocks\PointsDisplayIntegration.php:36
actionenqueue_block_editor_assetssrc\Infrastructure\Blocks\PointsDisplayIntegration.php:37
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\PointsDisplayIntegration.php:38
actioninitsrc\Infrastructure\Blocks\ProductPointsBlock.php:71
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\ProductPointsBlock.php:72
actioninitsrc\Infrastructure\Blocks\ReferralRewardsBlock.php:60
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\ReferralRewardsBlock.php:61
actioninitsrc\Infrastructure\Blocks\SpendRulesCheckoutIntegration.php:36
actionenqueue_block_editor_assetssrc\Infrastructure\Blocks\SpendRulesCheckoutIntegration.php:37
actioninitsrc\Infrastructure\Blocks\SpendRulesListBlock.php:62
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\SpendRulesListBlock.php:63
actioninitsrc\Infrastructure\Blocks\TiersListBlock.php:60
actionwp_enqueue_scriptssrc\Infrastructure\Blocks\TiersListBlock.php:61
actioninitsrc\Infrastructure\Services\ContentBlockManager.php:58
actionadmin_menusrc\Infrastructure\Services\ContentBlockManager.php:59
actionadd_meta_boxessrc\Infrastructure\Services\ContentBlockManager.php:60
actionsave_postsrc\Infrastructure\Services\ContentBlockManager.php:61
actionwpsrc\Infrastructure\Services\ContentBlockRenderer.php:96
actioninitsrc\Infrastructure\Services\PostTypeRegistrar.php:51
actioninitsrc\Infrastructure\Services\PostTypeRegistrar.php:52
actioninitsrc\Infrastructure\Services\PostTypeRegistrar.php:53
actionleat_contact_createdsrc\Infrastructure\Services\ReferralTrackingService.php:59
actionleat_daily_webhook_checksrc\Infrastructure\Services\WebhookManager.php:113
actioninitsrc\Infrastructure\Services\WooCommerceAccountTab.php:52
filterwoocommerce_account_menu_itemssrc\Infrastructure\Services\WooCommerceAccountTab.php:55
actionwoocommerce_account_leat-dashboard_endpointsrc\Infrastructure\Services\WooCommerceAccountTab.php:58
filterwoocommerce_get_query_varssrc\Infrastructure\Services\WooCommerceAccountTab.php:61
actionadmin_noticessrc\Infrastructure\Services\WooCommerceAccountTab.php:67
actionwoocommerce_blocks_loadedsrc\Infrastructure\StoreApi\GiftcardExtension.php:63
actionwoocommerce_blocks_loadedsrc\Infrastructure\StoreApi\LeatCartExtension.php:107
actionwoocommerce_blocks_loadedsrc\Infrastructure\StoreApi\PointsExtension.php:85
actioninitsrc\Plugin.php:27
filterplugin_action_links_leat-crm/leat-crm.phpsrc\Plugin.php:28
actionactivated_pluginsrc\Plugin.php:29
actionadmin_initsrc\Plugin.php:30
actionadmin_noticessrc\Plugin.php:101
actioninitsrc\Plugin.php:129
actionadmin_menusrc\Plugin.php:130
actionrest_api_initsrc\Rest\ContactEndpoint.php:85
actionrest_api_initsrc\Rest\CouponsEndpoint.php:95
actionrest_api_initsrc\Rest\EarnRulesEndpoint.php:99
actionrest_api_initsrc\Rest\EnrollmentEndpoint.php:43
actionrest_api_initsrc\Rest\GiftcardsEndpoint.php:75
actionrest_api_initsrc\Rest\GiftcardSessionEndpoint.php:72
actionwoocommerce_store_api_checkout_update_order_from_requestsrc\Rest\GiftcardSessionEndpoint.php:75
actionrest_api_initsrc\Rest\PointsCalculationEndpoint.php:80
actionrest_api_initsrc\Rest\PromotionRulesEndpoint.php:75
actionrest_api_initsrc\Rest\SettingsEndpoint.php:76
actionrest_api_initsrc\Rest\ShopsEndpoint.php:63
actionrest_api_initsrc\Rest\SpendRulesEndpoint.php:96
actionrest_api_initsrc\Rest\SyncEndpoint.php:96
actionrest_api_initsrc\Rest\TiersEndpoint.php:62
actionrest_api_initsrc\Rest\WCCategoriesSearchEndpoint.php:50
actionrest_api_initsrc\Rest\WCProductsSearchEndpoint.php:50
actionrest_api_initsrc\Rest\WebhooksEndpoint.php:58
actionwp_enqueue_scriptssrc\Shortcodes\CustomerDashboardShortcode.php:78
actionwp_enqueue_scriptssrc\Shortcodes\ReferralShortcode.php:47
filtercron_schedulessrc\Utils\BackgroundProcess.php:146
filterwp_send_new_user_notification_to_usersrc\Utils\Users.php:29
filterwp_send_new_user_notification_to_adminsrc\Utils\Users.php:30
filterscript_loader_tagsrc\Utils\Vite.php:128
filterwp_inline_script_attributessrc\Utils\Vite.php:238

Scheduled Events 2

leat_delayed_contact_sync
leat_daily_webhook_check
Maintenance & Trust

Leat Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 13, 2026
PHP min version7.4
Downloads5K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

Leat Developer Profile

Rens Nitert

1 plugin · 10 total installs

94
trust score
Avg Security Score
100/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Leat

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/leat-crm/assets/css/debug-toolbar.css/wp-content/plugins/leat-crm/assets/js/debug-toolbar.js
Version Parameters
leat-crm/assets/css/debug-toolbar.css?ver=leat-crm/assets/js/debug-toolbar.js?ver=

HTML / DOM Fingerprints

CSS Classes
leat-debug-toolbarleat-debug-collapsedleat-debug-inlineleat-debug-positioningleat-debug-launcherleat-debug-launcher-iconleat-debug-panelleat-debug-header+3 more
HTML Comments
<!-- Displays a floating debug toolbar for Leat order information. --><!-- Only shown when on a local site with WP_DEBUG enabled. --><!-- Get current order if on order page. --><!-- Get current user if on user edit page. -->+16 more
Data Attributes
aria-label="Open Leat Debug Panel"aria-label="Close"
JS Globals
leatDebugToolbarleat_debug_nonce
FAQ

Frequently Asked Questions about Leat