Bitcoin Payments – Blockonomics Security & Risk Analysis

The 'blockonomics-bitcoin-payments' plugin v3.9.0 presents a mixed security posture. While it demonstrates some good practices, such as a significant percentage of SQL queries using prepared statements and a good number of nonce and capability checks in its code, there are notable areas of concern. The presence of an unprotected AJAX handler is a significant risk, as it represents an entry point that could be exploited without proper authentication. Furthermore, the taint analysis reveals a concerning trend of unsanitized paths in all analyzed flows, although thankfully, these did not escalate to critical or high severity vulnerabilities in this scan. The vulnerability history indicates past issues with Cross-Site Scripting (XSS), with two medium severity CVEs recorded. The fact that the most recent vulnerability was in January 2023 and is currently unpatched suggests a potential for lingering security weaknesses or a lack of consistent security maintenance. In conclusion, while the plugin has areas of strength, the unprotected AJAX endpoint and the patterns identified in taint analysis, combined with past XSS vulnerabilities, necessitate careful attention to mitigate potential risks.