An issue exists where the plugin does not require authentication or a valid nonce for an action that triggers a slow server-side loopback request. This allows unauthenticated attackers to exhaust the site's PHP worker pool, resulting in a denial of service that makes the entire site unavailable.