OXXO PAY powered by Spin Security & Risk Analysis

The digitalfemsa-payment-gateway plugin version 1.0.10 presents a mixed security posture. On the positive side, the static analysis indicates a lack of critical vulnerabilities such as dangerous functions, raw SQL queries, unsanitized paths in taint analysis, and external HTTP requests. The absence of known CVEs further contributes to an impression of a relatively secure plugin. However, several areas raise significant concerns. The low percentage of properly escaped output (65%) suggests a high risk of Cross-Site Scripting (XSS) vulnerabilities, especially given the total number of outputs analyzed. Additionally, the complete absence of nonce checks and capability checks across all entry points is a major oversight, leaving the plugin vulnerable to various forms of unauthorized actions and privilege escalation if any entry points were to be discovered or become accessible in future updates. The presence of file operations also warrants careful consideration, as these could be exploited if not properly secured.