MIRATIO – Facturación electrónica Perú Security & Risk Analysis

The "miratio" v2.6 plugin exhibits a concerning security posture due to several critical oversights in its code. While it appears to have no known historical vulnerabilities and uses prepared statements for its SQL queries, these positives are overshadowed by significant weaknesses in its entry points and data sanitization. The plugin exposes two AJAX handlers without any authentication or capability checks, creating a direct path for attackers to interact with the plugin's functionality without proper authorization. Furthermore, the taint analysis reveals flows with unsanitized paths, indicating that user-supplied input might not be adequately validated or escaped before being processed, which could lead to various injection vulnerabilities. The extremely low percentage of properly escaped output also raises alarms, suggesting a high likelihood of cross-site scripting (XSS) vulnerabilities. The lack of nonce checks on its AJAX endpoints is another major concern. Despite the absence of recorded CVEs, the identified code signals point to substantial potential risks that could be exploited in the wild.