Global Payments SecureSubmit Gateway Security & Risk Analysis

The plugin "woocommerce-securesubmit-gateway" v4.0.0 presents a mixed security posture. On the positive side, it boasts a clean vulnerability history with no known CVEs, indicating a generally well-maintained codebase. The high percentage of properly escaped outputs (97%) and the presence of nonce checks are also good security practices.

However, significant concerns arise from the static analysis. The plugin exposes a considerable attack surface through its AJAX handlers, with all four handlers lacking proper authentication checks. This could allow unauthenticated users to trigger sensitive actions. Additionally, the presence of the `unserialize` function is a red flag, as it can lead to Remote Code Execution vulnerabilities if not handled with extreme care and input validation. The single SQL query found is not using prepared statements, which is a significant risk for SQL injection. The lack of taint analysis data makes it difficult to fully assess the impact of these issues, but the identified vulnerabilities are serious enough to warrant caution.

In conclusion, while the plugin has a history of security, the current version exhibits critical weaknesses in its handling of AJAX requests and the use of dangerous functions and un-prepared SQL queries. These issues introduce a substantial risk of unauthorized access and data manipulation, outweighing the positive aspects like a clean vulnerability history and good output escaping.