Sezzle Woocommerce Payment Security & Risk Analysis

The sezzle-woocommerce-payment plugin version 6.1.5 exhibits a mixed security posture. On the positive side, it shows strong output escaping practices (95%) and a clean vulnerability history with no known CVEs. The absence of dangerous functions, shortcodes, and REST API routes also contributes to a reduced attack surface in those areas. However, there are significant concerns regarding its handling of AJAX requests. The plugin has 10 AJAX handlers, with 2 of them lacking proper authentication checks, creating potential entry points for unauthorized actions. Additionally, all SQL queries are executed without prepared statements, posing a risk of SQL injection vulnerabilities, especially if any data manipulation occurs. While taint analysis did not reveal critical or high severity issues, the presence of two flows with unsanitized paths warrants attention and further investigation. The lack of capability checks for AJAX handlers is a notable weakness that, combined with the unprotected AJAX endpoints, amplifies the risk.