Knit Pay – Cashfree, Instamojo, Razorpay, Paypal and more Security & Risk Analysis

The knit-pay plugin v9.2.3.0 presents a mixed security posture. On the positive side, the plugin has no recorded historical vulnerabilities, indicating a generally stable and well-maintained codebase. The majority of SQL queries utilize prepared statements, and a good percentage of output is properly escaped, which are strong indicators of secure coding practices. However, the static analysis reveals several concerning areas. The presence of one AJAX handler without authentication checks is a significant risk, potentially allowing unauthorized actions. Additionally, the use of the `unserialize` function is a known dangerous practice that can lead to deserialization vulnerabilities if not handled with extreme caution and strict input validation, and the taint analysis shows a notable number of flows with unsanitized paths, although none reached critical or high severity in this analysis. The large number of external HTTP requests also warrants careful review for potential vulnerabilities like SSRF.