Coinley – Cryptocurrency Payments Security & Risk Analysis

The "coinley-payment-gateway" plugin version 1.1.5 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and implementing nonce checks and capability checks for all but two AJAX handlers. The absence of known CVEs and a clean vulnerability history is also a strong indicator of robust past development. However, the presence of two AJAX handlers without authentication checks represents a significant concern, creating potential entry points for unauthorized actions if these handlers can be triggered externally. While taint analysis showed no critical or high severity flows, the limited scope of analysis (0 flows) means this data might not be fully representative of all potential data handling issues. The plugin's overall security is generally good due to strong SQL and nonce practices, but the unprotected AJAX endpoints introduce a notable risk that needs to be addressed.