CorvusPay WooCommerce Payment Gateway Security & Risk Analysis

The CorvusPay WooCommerce Integration plugin, version 2.7.2, exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices with a high percentage of properly escaped outputs and a lack of known critical vulnerabilities or dangerous function usage. The absence of external HTTP requests and bundled libraries also reduces potential attack vectors. However, there are notable concerns regarding the plugin's attack surface and data handling. The presence of two REST API routes without permission callbacks presents a significant risk, as these endpoints are accessible without proper authentication or authorization, potentially allowing unauthorized access to sensitive data or functionality. Furthermore, the single SQL query identified is not using prepared statements, which could lead to SQL injection vulnerabilities if user-supplied data is not meticulously handled before being used in the query. While no taint flows were detected, the raw SQL query and unprotected REST API endpoints are clear indicators of potential weaknesses that require immediate attention.