Formipay – Donations & Instant Payment Forms (Paystack, Flutterwave & More) Security & Risk Analysis

The plugin "formipay" v2.0.1 exhibits a generally good security posture with several positive indicators. The absence of any recorded vulnerabilities, including critical or high severity ones, is a significant strength. Furthermore, the code demonstrates good practices with 100% of SQL queries using prepared statements and a high percentage (94%) of output properly escaped, mitigating common attack vectors like SQL injection and Cross-Site Scripting (XSS). Taint analysis also found no critical or high severity flows with unsanitized paths. However, the plugin does present some areas of concern. It has two AJAX handlers that lack authentication checks, representing a direct entry point for potential unauthorized actions or information disclosure if these handlers perform sensitive operations. While the total number of entry points is relatively small, these unprotected AJAX handlers are a notable weakness. The presence of one file operation and two external HTTP requests, while not inherently malicious, warrants careful scrutiny for potential vulnerabilities if not handled securely, especially in conjunction with the unprotected AJAX endpoints. Overall, the plugin is built on a solid foundation with good security practices, but the unprotected AJAX handlers introduce a specific, actionable risk that needs attention.