Split Pay – Stripe Connect Split Payments & Multi-Vendor Marketplace for WooCommerce Security & Risk Analysis

The bsd-woo-stripe-connect-split-pay plugin v3.6.2 presents a mixed security posture. On the positive side, it demonstrates good practices by implementing nonce checks on all AJAX handlers and capability checks on its entry points, and it has no publicly known vulnerabilities. However, the static analysis reveals concerning areas. A significant portion of SQL queries (47%) do not utilize prepared statements, increasing the risk of SQL injection vulnerabilities. Furthermore, the taint analysis identified 4 high-severity flows with unsanitized paths, indicating potential injection vectors that could be exploited if not handled carefully. The proper output escaping is also only at 47%, which could lead to cross-site scripting (XSS) vulnerabilities if user-supplied data is not consistently and correctly escaped before being displayed.

While the plugin's vulnerability history is clean, this does not negate the risks identified in the static and taint analyses. The presence of high-severity taint flows and a substantial percentage of unescaped output are critical areas that require immediate attention. The absence of recorded vulnerabilities might be due to the lack of rigorous external auditing or that the identified risks have not yet been exploited in the wild. Overall, the plugin has strengths in its access control mechanisms, but weaknesses in data sanitization and output escaping necessitate caution.