sql-injection-prevention

No clear malicious or supply-chain behavior is present. SQL injection is largely mitigated through type conversion, escaping, allowlists, prepared statements, and WordPress database APIs. However, the fragment performs insertion, status updates, and deletions without visible permission checks or nonce validation, and some destructive actions use a GET-derived ID. If exposed without surrounding access controls, this could permit unauthorized data modification or CSRF-based destructive actions.