bSecure – Your Universal Checkout Security & Risk Analysis

The "bsecure" v2.0.0 plugin presents a mixed security posture. While it demonstrates good practices like using prepared statements for all SQL queries and has a relatively low number of file operations and external HTTP requests, significant concerns exist regarding its attack surface and past vulnerability history. The presence of 10 unprotected AJAX handlers is a major red flag, as these can be leveraged by unauthenticated users to trigger plugin functionality, potentially leading to various attacks if not properly secured. The taint analysis, while showing no critical or high severity flows, did identify flows with unsanitized paths, indicating a potential for subtle vulnerabilities that might be overlooked.

The vulnerability history is particularly alarming, with two currently unpatched CVEs, one of critical severity and one high. The common vulnerability types of Missing Authorization and SQL Injection in its history directly correlate with the static analysis findings of unprotected AJAX handlers and the taint analysis's unsanitized paths. This pattern suggests a recurring weakness in input validation and access control within the plugin. While the plugin's use of prepared statements is a strength, the presence of unpatched critical vulnerabilities and a large number of unprotected entry points outweighs this positive aspect, demanding immediate attention.