Desconto Automático por Método de Pagamento | Cyfer Security & Risk Analysis

The "cyfer-automatic-discount-per-payment-method" plugin v1.0.1 exhibits a mixed security posture. While it demonstrates good practices in its handling of SQL queries (100% prepared statements) and output escaping (96%), the presence of two AJAX handlers without authentication checks is a significant concern. This creates direct entry points into the application that could be exploited by unauthenticated users. The taint analysis shows no concerning flows, which is positive, and the plugin has no recorded vulnerability history, suggesting a relatively clean track record so far. However, the lack of authentication on critical entry points outweighs these strengths, making it susceptible to potential attacks that could manipulate discount logic or other functionalities exposed via these AJAX endpoints. The plugin relies on a bundled library, Select2, whose version is not specified, which could be a minor concern if it's an older, known-vulnerable version, though no specific issues are highlighted in the provided data.