Pay with ATH Movil (WooCommerce payment gateway) Security & Risk Analysis

The plugin "pay-with-ath-movil-woocommerce-gateway" v1.2.2 exhibits a concerning security posture primarily due to its unprotected entry points. While the absence of dangerous functions, raw SQL queries, and known vulnerabilities is a positive sign, the presence of four AJAX handlers without any authentication checks presents a significant risk. This means that any user, regardless of their logged-in status or role, could potentially trigger these AJAX actions, opening the door to various attacks if these handlers perform sensitive operations. The plugin also shows a weakness in output escaping, with only 50% of outputs being properly escaped, which could lead to Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not handled securely. The lack of recorded vulnerabilities in its history is a good indicator, but it doesn't negate the immediate risks identified in the static analysis.