Robokassa payment gateway for Woocommerce Security & Risk Analysis

The robokassa plugin version 1.8.5 presents a mixed security posture. On the positive side, it demonstrates good practices in handling SQL queries, exclusively using prepared statements, and its taint analysis did not reveal any critical or high-severity vulnerabilities. The plugin also avoids bundling external libraries, which can often introduce vulnerabilities if not kept up-to-date.

However, significant concerns arise from the attack surface. With two AJAX handlers, both lacking authentication checks, this opens up potential avenues for unauthorized actions. Furthermore, the plugin has a history of known vulnerabilities, with one CVE still unpatched. The commonality of Cross-site Scripting (XSS) in past vulnerabilities, combined with a concerning 57% of outputs being not properly escaped, suggests a persistent weakness in input validation and output sanitization. The absence of nonce checks on AJAX actions is a critical oversight that directly correlates with XSS risks.

While the plugin doesn't exhibit severe code-level vulnerabilities in the current static analysis, the unpatched CVE, unprotected AJAX endpoints, and the history of XSS vulnerabilities, especially when coupled with insufficient output escaping and missing nonce checks, indicate a medium to high-risk profile. A proactive approach is needed to address the unpatched vulnerability and to secure the AJAX endpoints.