ifthenpay | Payments for WPForms

PHP Compatibility

Categories with Findings

Positive Observations

• All plugin state options use update_option(..., false) / add_option(..., 'no') — none autoload, keeping the autoloaded options table small.
• ExpiredPaymentsCron uses $wpdb->prepare() with the %i identifier placeholder and a hard LIMIT 500 (MAX_PER_RUN), plus a re-check before write, avoiding both injection and unbounded sweeps.
• PaymentRecordStore correctly passes ['cap' => false] to WPForms Payment API so guest/webhook updates are not silently dropped.
• EntryManager uses an atomic add_option() lock (unique index) rather than a check-then-set transient, correctly avoiding a race that would double-create entries.
• PaymentDataPreparer::get_context() memoizes its resolved context in $resolved_context, avoiding repeated resolution within a request.
• IfthenpayClient::request() centralizes HTTP handling with sslverify enabled and consistent error handling via RuntimeException.
• HTML output in IfthenpayEmailHelper and EntryPreviewRenderer is consistently escaped with esc_html(), and the email body is built via output buffering rather than echoed at call time.