RealHomes Stripe Payments Security & Risk Analysis

The 'inspiry-stripe-payments' plugin version 2.0.9 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices by exclusively using prepared statements for SQL queries, performing output escaping on a high percentage of outputs, and having no known historical vulnerabilities. The absence of critical taint flows and dangerous functions is also reassuring.

However, a significant concern lies within its attack surface. The presence of one AJAX handler that lacks authentication checks presents a direct vulnerability. While the plugin includes one nonce check, its application to this unprotected AJAX handler is not guaranteed by the provided data. The lack of capability checks on any entry points is another weakness that could be exploited if an attacker can trigger the unprotected AJAX handler.

Overall, the plugin's clean vulnerability history suggests diligent maintenance. Nevertheless, the identified unprotected AJAX endpoint is a critical flaw that requires immediate attention. Addressing this single point of entry without proper authorization is paramount to improving the plugin's security.