Your plugin messes up other plugins.

Your plugin assumes that if a URL contains parameter “code” it belongs to it. There are many other plugins that could do authorizations that return that variable in URL.

This is NOT OK: (file callback.php)

$code = isset( $_REQUEST['code'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['code'] ) ) : '';// WPCS: CSRF ok,Input var okay.
$url  = admin_url( "admin.php?page=mb_email_configuration&access_token=$code" );
header( "location: $url" );
exit();

You MUST check that you initiated authorization. Please use ‘state’ parameter, it is existing specifically for that reason.

Right now you are hijacking all authorizations and even some unrelated pages from other plugins.