Subscription ePayco Security & Risk Analysis

The "subscription-epayco" plugin version 4.0.2 exhibits a concerning security posture due to its unprotected entry points. While the plugin demonstrates good practices in other areas, such as avoiding dangerous functions, utilizing prepared statements for most SQL queries, and having no recorded vulnerabilities, the presence of three AJAX handlers without any authentication or capability checks is a significant risk. This directly exposes these handlers to potential abuse by unauthenticated users, which could lead to various forms of attacks depending on their functionality.

The code analysis reveals a notable weakness in output escaping, with only 35% of outputs being properly escaped. This, combined with the unprotected AJAX endpoints, increases the likelihood of cross-site scripting (XSS) vulnerabilities. Despite the absence of critical taint flows and a clean vulnerability history, the unprotected entry points and insufficient output escaping represent the most immediate threats. A robust security strategy would prioritize securing these AJAX handlers and improving output sanitization to mitigate these risks.