FundEngine – Donation and Crowdfunding Platform Security & Risk Analysis

The wp-fundraising-donation plugin v1.7.5 exhibits a mixed security posture, with some strong practices offset by significant vulnerabilities. While the plugin demonstrates good use of prepared statements for SQL queries (99%) and a high percentage of properly escaped output (87%), the presence of 3 'unserialize' function calls is a red flag, as this function is notoriously prone to deserialization vulnerabilities if not handled with extreme caution and proper input validation. Furthermore, the plugin has a considerable attack surface with 32 entry points, of which a concerning 21 are unprotected, including 2 AJAX handlers and all 19 REST API routes lacking permission callbacks. The taint analysis reveals 4 high-severity flows with unsanitized paths, indicating potential for exploitation.