Skrill – WooCommerce Security & Risk Analysis

The official-skrill-woocommerce plugin, version 1.0.72, exhibits a mixed security posture. On the positive side, the plugin demonstrates strong adherence to secure coding practices by exclusively using prepared statements for all SQL queries and properly escaping all output. There are no instances of dangerous function usage, file operations, or bundled libraries, which are all positive indicators. However, significant security concerns arise from its attack surface. All two identified REST API entry points lack permission callbacks, meaning they are accessible without any authentication or authorization checks. This presents a considerable risk for potential unauthorized access or manipulation of sensitive data. The plugin also has a history of vulnerabilities, with one medium-severity CVE previously recorded, indicating a potential for security weaknesses to emerge over time. While currently unpatched CVEs are zero, the past incident combined with the unprotected entry points warrants attention.

While the internal code itself seems to follow good practices regarding SQL and output, the external-facing REST API routes are a major point of concern. The absence of any capability checks on these routes is a critical flaw, exposing them to potential abuse by unauthenticated users. The plugin's history of a medium-severity CVE, although resolved, highlights that the plugin is not immune to security flaws. In conclusion, the plugin has strengths in its data handling and output sanitization, but the unprotected REST API endpoints are a serious weakness that significantly increases its overall risk profile. Developers should prioritize implementing robust permission checks on all API routes to mitigate this risk.