Plugin destroyed site bandwidth

After a client start experiencing issues with their website, I discovered in the access + error logs that this plugin was flooding the website with hits to the URL:

/?ob=open-bridge/events

repeating literally seconds apart, each giving an internal server error with the stack trace (sanitized below):

PHP Fatal error: Uncaught FacebookAds\Http\Exception\AuthorizationException: Error validating access token: Invalid session for app in xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Http/Exception/RequestException.php:174

Stack trace:

#0 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Http/Client.php(226): FacebookAds\Http\Exception\RequestException::create(Object(FacebookAds\Http\Response))
#1 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Http/Request.php(286): FacebookAds\Http\Client->sendRequest(Object(FacebookAds\Http\Request))
#2 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Api.php(152): FacebookAds\Http\Request->execute()
#3 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Api.php(205): FacebookAds\Api->executeRequest(Object(FacebookAds\Http\Request))
#4 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/ApiRequest.php(171): FacebookAds\Api->call('/xxx...', 'POST', Array, Array)
#5 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Object/AdsPixel.php(292): FacebookAds\ApiRequest->execute()
#6 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Object/ServerSide/EventRequest.php(284): FacebookAds\Object\AdsPixel->createEvent(Array, Array)
#7 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Object/ServerSide/EventRequest.php(277): FacebookAds\Object\ServerSide\EventRequest->defaultExecute()
#8 xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Object/ServerSide/EventRequest.php(247): FacebookAds\Object\ServerSide\EventRequest->sendToCAPIEndpoint()
#9 xxx/wp-content/plugins/official-facebook-pixel/core/class-facebookserversideevent.php(197): FacebookAds\Object\ServerSide\EventRequest->execute()
#10 xxx/wp-content/plugins/official-facebook-pixel/core/class-facebookwordpressopenbridge.php(162): FacebookPixelPlugin\Core\FacebookServerSideEvent::send(Array)
#11 xxx/wp-content/plugins/official-facebook-pixel/facebook-for-wordpress.php(124): FacebookPixelPlugin\Core\FacebookWordpressOpenBridge->handle_open_bridge_req(Array)
#12 xxx/wp-includes/class-wp-hook.php(324): FacebookPixelPlugin\FacebookForWordpress->handle_events_request(Object(WP))
#13 xxx/wp-includes/class-wp-hook.php(348): WP_Hook->apply_filters('', Array)
#14 xxx/wp-includes/plugin.php(565): WP_Hook->do_action(Array)
#15 xxx/wp-includes/class-wp.php(418): do_action_ref_array('parse_request', Array)
#16 xxx/wp-includes/class-wp.php(818): WP->parse_request('')
#17 xxx/wp-includes/functions.php(1342): WP->main('')
#18 xxx/wp-blog-header.php(16): wp()
#19 xxx/index.php(17): require('xxx...')
#20 {main}

 thrown in xxx/wp-content/plugins/official-facebook-pixel/vendor/facebook/php-business-sdk/src/FacebookAds/Http/Exception/RequestException.php on line 174

This resulted in the webhost’s entirely monthly bandwidth allowage being used in a few hours.

Obviously there was some issue with the connection between your plugin and Facebook, but not matter what the cause is, the plugin should never fail in this disastrous and expensive way.

The lack of error checking means this isn’t a plugin we’ll be using again.