Frisbii Pay Security & Risk Analysis

The reepay-checkout-gateway plugin v1.8.9 exhibits a mixed security posture. While it demonstrates good practices in using prepared statements for SQL queries and incorporates a reasonable number of capability checks and nonces, there are significant concerns regarding its attack surface and input sanitization. The high number of AJAX handlers, particularly the six without explicit authentication checks, presents a substantial risk. Although taint analysis did not reveal critical or high severity vulnerabilities in this specific scan, the presence of three flows with unsanitized paths warrants attention. The plugin's vulnerability history shows one known medium-severity CVE, which is thankfully patched. However, the common vulnerability type being 'Missing Authorization' aligns with the static analysis findings of unprotected AJAX endpoints, suggesting a recurring pattern. Overall, the plugin has strengths in its database interaction and some security checks, but the lack of robust authentication on a significant portion of its AJAX endpoints is a primary concern that could be exploited if not properly addressed.