GoUrl Paid Memberships Pro – Bitcoin Payment Gateway Addon Security & Risk Analysis

The static analysis of gourl-bitcoin-paid-memberships-pro v1.1.8 reveals a generally strong security posture with no identified entry points that are not properly authenticated or authorized. The absence of AJAX handlers, REST API routes, shortcodes, and cron events with unprotected access is a significant positive indicator. The code also shows no signs of dangerous function usage, file operations, or external HTTP requests, further contributing to a reduced attack surface.

However, there are notable areas for concern. The analysis indicates that 100% of SQL queries are executed without prepared statements, posing a significant risk of SQL injection vulnerabilities, especially if any of the query inputs are user-controlled. While the taint analysis shows no critical or high-severity unsanitized paths, the lack of prepared statements means potential injection vectors could exist. The limited number of capability checks (only 1) suggests that authorization for certain actions might not be robustly implemented across the plugin.

Furthermore, the plugin has no recorded vulnerability history, which is excellent. This suggests a history of secure development or diligent patching. Despite the positive vulnerability history, the lack of prepared statements in all SQL queries and the limited capability checks present tangible risks that require attention. The overall security is good due to the limited attack surface and lack of known vulnerabilities, but the identified code-level weaknesses, particularly in SQL query handling, lower its score.