Viva Payments – Viva Wallet WooCommerce Payment Gateway Security & Risk Analysis

The plugin "woo-payment-gateway-for-vivapayments" v1.4.0.1 exhibits a generally good security posture with no recorded historical vulnerabilities. The static analysis indicates a minimal attack surface, with no exposed AJAX handlers, REST API routes, shortcodes, or cron events. This absence of direct entry points is a significant strength. However, concerns arise from the taint analysis, which reveals 3 high-severity flows with unsanitized paths. While the static analysis did not detect any dangerous functions or specific SQL injection vulnerabilities due to lack of prepared statements, these unsanitized flows suggest a potential risk if user-supplied data is not properly handled before being processed by potentially vulnerable backend operations. The plugin also uses external HTTP requests, which could be a vector if not properly secured. The lack of nonce and capability checks, combined with a moderate percentage of SQL queries not using prepared statements, points to areas where further hardening could significantly improve security.