WP PayMobile Content Locker Security & Risk Analysis

The wp-paymobile-content-locker v1.3 plugin exhibits several concerning security practices despite having no recorded historical vulnerabilities. The static analysis reveals a critical lack of input sanitization and capability checks, particularly highlighted by two high-severity taint flows with unsanitized paths. Furthermore, the absence of nonce checks on any entry points (even though none are explicitly marked as unprotected in the 'attack surface' section, the general lack of checks is worrying) and the low percentage of properly escaped output (18%) create significant opportunities for cross-site scripting (XSS) and other injection attacks. While the plugin doesn't utilize dangerous functions or make external HTTP requests, and its SQL queries show some use of prepared statements, these strengths are overshadowed by the fundamental weaknesses in handling user input and enforcing permissions. The lack of vulnerability history is positive but can also be misleading if not accompanied by robust security practices, which are clearly lacking here.