PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) Security & Risk Analysis

The peachpay-for-woocommerce plugin version 1.120.17 presents a mixed security posture. While the static analysis shows a relatively low number of dangerous functions, a good percentage of output escaping, and a reasonable number of nonce and capability checks, there are significant areas of concern. The high number of AJAX handlers without authentication checks (17 out of 36) and REST API routes without permission callbacks (1 out of 2) create a substantial attack surface that could be exploited by unauthenticated users. The taint analysis, though showing no critical or high severity flows, does indicate 11 flows with unsanitized paths, which warrants further investigation as these could potentially lead to vulnerabilities if exploited in conjunction with other weaknesses.

The plugin's vulnerability history is a major red flag. With a total of 4 known CVEs, all of which are currently patched, the historical pattern of medium severity vulnerabilities including Missing Authorization, SQL Injection, and Cross-site Scripting suggests recurring security weaknesses. The fact that the last vulnerability was as recent as January 2026 indicates ongoing challenges in securing the plugin. While no unpatched vulnerabilities currently exist, the history strongly suggests that new vulnerabilities are likely to emerge if development practices do not significantly improve.

In conclusion, while the plugin has some positive security attributes like proper output escaping and the absence of critical taint flows, the large number of unprotected entry points and the history of multiple medium severity vulnerabilities are serious concerns. The potential for attackers to exploit unauthenticated AJAX endpoints or REST API routes, combined with past occurrences of injection and authorization flaws, necessitates caution. Users should remain vigilant for future updates and consider alternative payment gateways if these security concerns are not addressed proactively by the developers.