GG Multiple Payment Routing for WooCommerce – Split and manage PayPal, Stripe accounts Security & Risk Analysis

The "gg-multiple-payment-routing" v1.0.8 plugin demonstrates a mixed security posture. On the positive side, it utilizes prepared statements for all SQL queries and has a good rate of output escaping (80%). The vulnerability history is clean, with no recorded CVEs, suggesting a generally secure development approach regarding known vulnerabilities. However, significant concerns arise from the static analysis. The plugin exposes two AJAX handlers, with one lacking any authentication checks. This unprotected entry point represents a direct pathway for potential attacks. Furthermore, the absence of nonce checks on AJAX handlers, combined with the single unprotected AJAX handler, significantly increases the risk of Cross-Site Request Forgery (CSRF) attacks. While the plugin has a limited attack surface and avoids dangerous functions, the lack of proper authentication and nonce verification on a critical entry point is a notable weakness.