WP Easy Pay – Payment and Donation form Builder for Square Security & Risk Analysis

The security posture of wp-easy-pay v4.2.12 presents a mixed bag of good practices and concerning weaknesses. On the positive side, the plugin demonstrates strong adherence to secure coding principles with a very high percentage of properly escaped outputs and all SQL queries utilizing prepared statements. The absence of critical or high-severity taint flows, dangerous functions, and file operations is also encouraging. However, a significant concern arises from the presence of one AJAX handler that lacks authentication checks, creating a direct attack vector.

The vulnerability history, while currently showing no unpatched CVEs, reveals a pattern of past medium-severity issues including Missing Authorization, Cross-Site Scripting, and Cross-Site Request Forgery. This suggests a historical tendency towards vulnerabilities that could be exploited by unauthorized users or lead to the execution of malicious scripts if proper input validation and output escaping were not in place. The recent vulnerability in July 2024, even if patched, indicates ongoing security challenges.

In conclusion, while the plugin has made strides in secure coding practices, the unprotected AJAX endpoint and the historical vulnerability types present tangible risks. The reliance on 18 nonce checks, while a good practice, is overshadowed by the single critical omission in authorization. The bundled Freemius and Guzzle libraries, while not explicitly flagged as outdated, warrant attention for potential supply chain risks in the future.