Фискализация чеков е-ОФД Security & Risk Analysis

The eofdsupport v1.0.8 plugin exhibits a concerning security posture primarily due to its unprotected AJAX handler, which represents a significant attack vector. While the plugin demonstrates good practices in terms of output escaping and avoids dangerous functions or file operations, the absence of authentication and capability checks on an entry point is a critical oversight. The presence of two flows with unsanitized paths in the taint analysis, though not reaching a critical or high severity in this specific scan, hints at potential vulnerabilities if user-supplied data is not properly validated and sanitized before being used in SQL queries or other sensitive operations. The plugin's clean vulnerability history is positive, suggesting a lack of past exploitation or discovery. However, this should not overshadow the immediate risks posed by the identified code signals.