Security and caching considerations

Hello, thank you for creating and maintaining this plugin.

I was about to use it, but performed a static code review of version 2.6.11 and found several issues that require attention.

1. Potential API credential exposure – critical
   Public event-tracking responses appear to include complete outbound request information. For Meta, Pinterest, TikTok, and Microsoft, this may expose API access tokens. The same information may also be stored in the plugin’s event-log table.I am intentionally not publishing reproduction details. Please provide a private security contact so I can share the evidence safely.
2. Missing authorization checks – high
   Several AJAX handlers that modify plugin settings validate a nonce but do not independently check an administrator capability such as manage_options.A nonce used by these handlers also appears to be loaded on wp-admin pages available to lower-privileged users. This may allow an authenticated low-privilege user to change platform, event, consent, or logging settings.
3. Public endpoint abuse – high
   Public tracking and logging endpoints lack sufficient rate limiting, replay protection, payload-size limits, and event-ID deduplication. They may be abused to:
4. Expired nonces in cached HTML
   Frontend AJAX nonces are embedded directly in page HTML. When a caching plugin serves that HTML from full-page cache after the nonce has expired, tracking requests fail until the cache is purged or regenerated.

I would really appreciate author’s reply on the matters above.

Thank you