Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Security & Risk Analysis

The 'wp-full-stripe-free' plugin version 8.4.1 presents a mixed security posture. While it demonstrates good practices in some areas, such as a high percentage of SQL queries using prepared statements and a significant number of nonce and capability checks, there are considerable concerns regarding its attack surface and output sanitization.

The plugin exposes a large attack surface with 96 AJAX handlers, a concerning 60 of which lack authentication checks. This significantly increases the potential for unauthorized actions if these handlers are not properly secured elsewhere. Furthermore, the taint analysis reveals a high number of flows with unsanitized paths (17 out of 19 analyzed), with 12 classified as high severity. This indicates a strong likelihood of vulnerabilities related to improper input handling that could lead to various security issues.

The vulnerability history shows 5 known CVEs, with past issues including SQL Injection, CSRF, and XSS. Although there are no currently unpatched vulnerabilities, the pattern of past vulnerabilities, particularly concerning input neutralization and authorization, aligns with the findings from the static analysis, suggesting persistent weaknesses in how user input is handled and validated. Despite the strengths in SQL query preparation, the significant number of unprotected AJAX handlers and the high severity taint flows are critical areas of concern.