iwocaPay Payment Gateway Security & Risk Analysis

The 'iwocapay-payment-gateway' plugin, version 1.3.2, exhibits a concerning security posture despite a clean vulnerability history. The static analysis reveals a significant attack surface consisting of four AJAX handlers, all of which lack authentication checks. This means any unauthenticated user could potentially trigger these handlers, leading to an exposure of sensitive functionality. The taint analysis further highlights this risk, with four flows analyzed, all involving unsanitized paths, although they are not classified as critical or high severity. This suggests a potential for issues if these paths are exploited, even if not immediately critical. The plugin also demonstrates poor output escaping practices, with only 19% of outputs properly escaped, increasing the risk of cross-site scripting (XSS) vulnerabilities. While the absence of known CVEs and dangerous functions is positive, the lack of nonces and capability checks on critical entry points, combined with the unsanitized taint flows, points to a need for immediate attention to secure these functions.