EBANX Payment Gateway for WooCommerce Security & Risk Analysis

The EBANX Payment Gateway for WooCommerce plugin version 1.41.3 presents a mixed security posture. On the positive side, it demonstrates good practices by heavily utilizing prepared statements for SQL queries and ensuring a high percentage of outputs are properly escaped. The absence of known CVEs and common vulnerability types in its history is also a strong indicator of past security diligence. However, the static analysis reveals a significant concern regarding its attack surface. With two AJAX handlers identified, both lacking proper authentication checks, there is a direct and accessible entry point for potential malicious actors. The limited taint analysis showing no critical or high-severity flows is reassuring, but the lack of analysis on flows with unsanitized paths means this area is not fully explored. The presence of a nonce check and capability checks on some entry points is positive, but does not mitigate the risk posed by the unprotected AJAX handlers.