CoffeeCode – Checkout for Getnet and WooCommerce Security & Risk Analysis

The wc-checkout-getnet plugin version 1.12.0 presents a mixed security posture. On the positive side, the code demonstrates strong practices regarding SQL queries, consistently utilizing prepared statements. Furthermore, the vast majority of output is properly escaped, and taint analysis shows no critical or high severity vulnerabilities, indicating good input sanitization for the analyzed flows. However, a significant concern arises from the large attack surface presented by AJAX handlers. A considerable number of these handlers (13 out of 17) lack authentication checks, leaving them open to potential unauthorized access or manipulation.

The vulnerability history reveals three medium-severity CVEs, all of which are now patched. The commonality of Cross-site Scripting vulnerabilities in the past suggests a historical weakness in output neutralization, though the current static analysis indicates significant improvement in this area. Despite the absence of currently unpatched CVEs and critical taint issues, the unprotected AJAX endpoints represent a tangible and immediate risk that could be exploited if not properly secured. The plugin also bundles Guzzle, which could be a point of concern if it's an outdated version, though this is not explicitly detailed in the provided data.