ShieldClimb – Crypto Payment Gateway for WooCommerce Security & Risk Analysis

The shieldclimb-crypto-payment-gateway plugin version 1.0.6 exhibits a concerning security posture primarily due to its extremely large, unprotected REST API attack surface. All 168 REST API routes lack permission callbacks, meaning any unauthenticated user can potentially interact with these endpoints, presenting a significant risk of unauthorized access or manipulation of functionalities. While the code demonstrates good practices in other areas, such as the complete absence of dangerous functions, 100% prepared SQL statements, and a high percentage of output escaping, these strengths are overshadowed by the critical flaw in REST API authentication. The plugin also has a history of zero known vulnerabilities, which is a positive sign, but this cannot compensate for the fundamental security gaps identified in the static analysis. The lack of taint analysis results could indicate either no flows were found or the analysis was not comprehensive, but the presence of numerous unprotected entry points is a concrete and severe risk that requires immediate attention.