Opayo Form Payment Gateway for Gravity Forms Security & Risk Analysis

The plugin "sagepay-form-payment-gateway-for-gravity-forms" version 1.1.9 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and has no recorded vulnerabilities or CVEs. This suggests a generally mature development process with a focus on preventing common database attacks and a good track record. However, the static analysis reveals a significant concern: one AJAX handler lacks authentication checks. This unprotected entry point creates a direct avenue for potential exploitation if it handles user-supplied data without proper authorization. The absence of taint analysis flows is a limitation, but the identified unprotected AJAX handler is a concrete risk that warrants attention.