whatwedo ACF Cleaner Security & Risk Analysis

The "whatwedo-acf-cleaner" v1.2.2 plugin exhibits a mixed security posture, with some positive indicators but significant concerns related to its attack surface and handling of dangerous functions. While the plugin demonstrates good practices in using prepared statements for SQL queries and has no recorded vulnerability history, the presence of multiple unprotected AJAX handlers is a major red flag. This directly exposes functionalities to potential unauthorized access and manipulation, especially given the use of the `unserialize` function, which can be a vector for remote code execution if user-supplied data is not strictly validated before deserialization.