GF Mollie by Indigo Security & Risk Analysis

The 'gf-mollie-by-indigo' plugin v2.1.2 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by exclusively using prepared statements for SQL queries, ensuring proper output escaping, and having no recorded vulnerabilities. This suggests a development team that is generally aware of common security pitfalls. However, a significant concern arises from the identified attack surface. The plugin exposes two AJAX handlers, both of which lack any form of authentication or capability checks. This means that any unauthenticated user can trigger these AJAX actions, creating a substantial risk if these handlers perform sensitive operations or can be manipulated to cause harm. The absence of any taint analysis findings and dangerous functions is encouraging, but it does not mitigate the direct risk posed by unprotected entry points.