Pretty Opt In Lite – Content Locker for Lead Generation Security & Risk Analysis

The "pretty-opt-in-lite" v1.3.20 plugin exhibits a generally good security posture, with a high percentage of properly escaped outputs and a significant portion of SQL queries utilizing prepared statements. The absence of dangerous functions, file operations, and recorded historical vulnerabilities suggests a development team that prioritizes security. However, there are two notable concerns regarding the attack surface. Specifically, six AJAX handlers are present, with two of them lacking any authentication checks. This could potentially expose these handlers to unauthorized access and manipulation, depending on their functionality.

While the taint analysis shows no critical or high severity unsanitized flows, and there are no known historical CVEs, the presence of unprotected AJAX endpoints remains a tangible risk. The plugin also bundles Select2 and Freemius v1.0, which, while not inherently problematic without version information, could be a point of concern if these libraries are outdated and contain known vulnerabilities. Overall, the plugin is strong in many areas but has a critical weakness in its AJAX endpoint security that needs immediate attention.