MultiSafepay plugin for WooCommerce Security & Risk Analysis

The multisafepay plugin version 6.12.0 exhibits a concerning security posture due to a significant number of unprotected entry points. All 12 AJAX handlers and 3 REST API routes lack proper authentication or permission checks, creating a large attack surface that could be exploited by unauthenticated users. While the code analysis indicates good practices regarding SQL queries (100% prepared statements) and a low number of file operations and external HTTP requests, the widespread lack of input validation on entry points is a critical weakness. The vulnerability history reveals a past Path Traversal vulnerability, which, combined with the current lack of input sanitization on entry points, suggests a potential for similar issues if data is not handled rigorously.

Despite the positive aspects of secure SQL execution and a decent output escaping rate (71%), the absence of authorization on numerous entry points overshadows these strengths. The taint analysis showing zero flows is encouraging, but it may not be comprehensive enough to detect vulnerabilities in the unprotected entry points that were not analyzed via taint flow. The plugin's history and current findings indicate a need for immediate attention to securing all entry points to prevent potential unauthorized access or data manipulation.