Yandex pay Security & Risk Analysis

The "yandex-pay" plugin version 1.1.4 exhibits a mixed security posture. On the positive side, there are no recorded historical vulnerabilities, no dangerous functions used, and all SQL queries are properly prepared, indicating good practices in database interaction. Output escaping is generally well-implemented, with over 90% of outputs being properly handled. However, several concerns arise from the static analysis. The absence of nonce checks and capability checks on any potential entry points is a significant weakness, especially considering the plugin makes 11 external HTTP requests. While the attack surface is reported as zero, this could be misleading if not all potential entry points were analyzed or if vulnerabilities exist within the external requests themselves. The taint analysis reveals two high-severity flows with unsanitized paths, which represent a tangible risk. These unsanitized paths could lead to potential injection vulnerabilities if external data is not handled with extreme care before being used in sensitive operations, particularly in conjunction with the external HTTP requests.