Merchium Shopping Cart Security & Risk Analysis

The Merchium v1.0.4 plugin exhibits a mixed security posture. While it demonstrates good practices by not utilizing dangerous functions, avoiding raw SQL queries, and having no recorded vulnerabilities, significant concerns arise from its attack surface and output escaping. The presence of three unprotected AJAX handlers represents a considerable risk, as these entry points are susceptible to unauthorized access and manipulation if not properly secured. Furthermore, the very low percentage of properly escaped output (10%) is a critical weakness, suggesting a high probability of cross-site scripting (XSS) vulnerabilities being present. The taint analysis, while indicating no critical or high severity flows, did identify two flows with unsanitized paths, which could potentially be exploited in conjunction with the output escaping issues.

Despite the lack of historical CVEs and a seemingly clean vulnerability record, the static analysis reveals fundamental security shortcomings that could be actively exploited. The combination of easily accessible AJAX endpoints and widespread unescaped output creates a fertile ground for attackers. The absence of nonce checks and capability checks on these AJAX handlers exacerbates this risk. In conclusion, while the plugin avoids certain common pitfalls, the identified vulnerabilities in its attack surface and output sanitization necessitate immediate attention to mitigate the risk of XSS and unauthorized access.