Significant Issues Found                                                                                                                                         
                                                                                                                                                                   
  Critical:                                                                                                                                                        
                                                                                                                                                                   
  1. Secret key logged to remote server — rtiService.php:233                                                                                                       
  The decryption secret is concatenated directly into log messages sent to an external logging endpoint. Any log aggregation compromise exposes it.                
  2. Insecure cookie handling — rtiService.php:141–145                                                                                                             
  Cookie name, value, expiry, and path are parsed from an external API response using array offsets with no bounds checking, no sanitization, and no               
  HttpOnly/Secure flags set.                                                                                                                                       
  3. Unvalidated POST data before decryption — rtiService.php:212–226                                                                                              
  $_POST['cheq_hash'] is passed to openssl_decrypt() without sanitization. The return value isn't checked for false before being passed to explode(), which will   
  produce unexpected behavior on decryption failure.                                                                                                               
  4. API response properties accessed without null check — rtiService.php:45–49                                                                                    
  json_decode($response_body)->isMonitoring — if the JSON is malformed or the property is absent, this produces a fatal error.                                     
                                                                                                                                                                   
  Medium:                                                                                                                                                          
                                                                                                                                                                   
  5. Race condition in interval tracking — clickcease.php:307–323
  The check-then-update pattern for rate-limiting API calls is not atomic, so concurrent requests can all pass the check and trigger redundant external API calls.
  6. GET parameters compared without sanitization — clickcease.php:97, 114                                                                                         
  $_GET["clickcease"] is compared directly. Currently safe due to strict equality checks, but not following WordPress best practices.                              
  7. echo json_encode() instead of wp_send_json_*() — multiple files                                                                                               
  Bypasses WordPress's proper content-type headers and JSON escaping conventions.