Interac e-Transfer / Email Money Transfer (EMT) Gateway for WooCommerce Security & Risk Analysis

The 'advanced-emt-payment-gateway' plugin v2.1.0 exhibits a mixed security posture. While it demonstrates good practices like 100% prepared statement usage for SQL queries and the absence of critical or high severity taint flows, significant concerns arise from its attack surface. The plugin exposes two AJAX handlers, both of which lack authentication checks, presenting a direct risk of unauthorized execution of plugin functionalities.

Despite the lack of recorded vulnerabilities in its history, the presence of unprotected AJAX endpoints is a critical security flaw. The plugin also has a moderate percentage of properly escaped outputs (71%), indicating potential for cross-site scripting (XSS) vulnerabilities in the remaining 29% of outputs. The bundled Freemius library, while common, should be monitored for its own security updates. The limited number of entry points is a positive, but the unprotected nature of these points overshadows this benefit.

In conclusion, the plugin has some strong security foundations, particularly in its database interaction. However, the unprotected AJAX endpoints create a substantial and easily exploitable attack vector. The moderate output escaping also warrants attention. Until these authentication and output sanitization issues are addressed, the plugin carries a significant risk of unauthorized actions and potential client-side attacks.