Morkva Plata by Mono Extended Security & Risk Analysis

The "mrkv-monobank-extended" plugin version 1.3.3 exhibits a mixed security posture. On the positive side, the plugin demonstrates good practices in handling SQL queries, exclusively using prepared statements, which significantly mitigates SQL injection risks. Additionally, there is no recorded vulnerability history, suggesting a generally stable and well-maintained codebase in the past.

However, significant concerns arise from the attack surface analysis. A substantial number of AJAX handlers (10 out of 10) lack authentication checks, creating a wide entry point for potential unauthorized actions. Furthermore, the taint analysis reveals 4 flows with unsanitized paths, indicating a risk of insecure handling of user-supplied data. The low percentage of properly escaped output (18%) also raises alarms about potential cross-site scripting (XSS) vulnerabilities when displaying data that might originate from user input or external sources.

In conclusion, while the plugin avoids common pitfalls like raw SQL and has a clean vulnerability history, the absence of authentication on numerous AJAX endpoints and the presence of unsanitized data flows are critical security weaknesses. The poor output escaping further compounds these risks. The plugin's overall security is compromised by these vulnerabilities, requiring immediate attention to protect the WordPress site.