Yesh Invoice – WooCommerce Payment Gateway Security & Risk Analysis

The "invoice-gateway-yeshinvoice" plugin v1.5.4 exhibits a mixed security posture. On the positive side, there are no registered CVEs, and the static analysis shows no identified dangerous functions, a low number of file operations, and a high percentage of properly escaped output. The absence of AJAX handlers, REST API routes, shortcodes, and cron events significantly limits the plugin's attack surface. However, several concerning areas require attention.

The plugin's SQL queries are a significant weakness. All three identified SQL queries are not using prepared statements, which presents a high risk of SQL injection vulnerabilities, especially given that taint analysis revealed flows with unsanitized paths. While no critical or high-severity taint flows were explicitly flagged, the presence of unsanitized paths in conjunction with raw SQL queries is a substantial concern. Furthermore, the complete lack of nonce and capability checks for any entry points, although the current attack surface is zero, means that if new entry points are added in the future, they would be inherently insecure.

The vulnerability history is clean, with no recorded CVEs. This is a positive indicator and might suggest diligent maintenance or a lack of past exploitable flaws. However, the raw SQL and unsanitized path findings are significant enough to warrant caution. The plugin's strengths lie in its limited attack surface and good output escaping. The primary weaknesses are the unescaped SQL queries and the potential for unsanitized path issues, which could be exploited if new entry points are introduced without proper security measures.