Multiple Payment Gateways for WooCommerce (WCMPG) Security & Risk Analysis

The plugin "wcmpg" v1.71 exhibits a concerning security posture primarily due to its lack of authentication and authorization checks on its entry points. The analysis reveals one unprotected AJAX handler, which presents a significant risk as unauthenticated users could potentially trigger its functionality. Furthermore, the presence of dangerous `exec` functions within the code signals a potential for remote code execution if these functions are reachable through an insecure entry point. While the plugin demonstrates good practices in SQL query handling by exclusively using prepared statements, and its vulnerability history is clean, these strengths are overshadowed by the critical deficiencies in securing its attack surface.