PluginScore

Backend Payments for WooCommerce

Process payments from the WooCommerce Edit Order screen.

v2.8.10bflUpdated Added 1k+ installs94% rating100% support resolved
backendmanualpaymentphonewoocommerce
35
Score
63
Errors
42
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance100
Maintainability55

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

105 findings

Security

65

9 issue groups

Maintainability

34

16 issue groups

ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Transaction type '$params[transaction_type]' was not found."'.30
Category
Security
Occurrences
30
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Transaction type '$params[transaction_type]' was not found."'.

WordPress.Security.EscapeOutput.ExceptionNotEscapedReference
ERRORMaintainabilityShort PHP open tag foundShort PHP opening tag used with echo; expected "<?php echo $this ..." but found "<?= $this ..."10
Category
Maintainability
Occurrences
10
Severity
error

Sample message

Short PHP opening tag used with echo; expected "<?php echo $this ..." but found "<?= $this ..."

Generic.PHP.DisallowShortOpenTag.EchoFound
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_POST[&#039;_ajax_nonce&#039;]7
Category
Security
Occurrences
7
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_POST[&#039;_ajax_nonce&#039;]

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
WARNINGSecurityRequest data is not unslashed$_POST[&#039;_ajax_nonce&#039;] not unslashed before sanitization. Use wp_unslash() or similar6
Category
Security
Occurrences
6
Severity
warning

Sample message

$_POST[&#039;_ajax_nonce&#039;] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$key'.5
Category
Security
Occurrences
5
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$key'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.5
Category
Security
Occurrences
5
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST[&#039;_ajax_nonce&#039;]. Check that the array index exists before using it.5
Category
Security
Occurrences
5
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST[&#039;_ajax_nonce&#039;]. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.4
Category
Security
Occurrences
4
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
WARNINGMaintainabilityMissing VersionResource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.

WordPress.WP.EnqueuedResourceParameters.MissingVersion
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;4
Category
Maintainability
Occurrences
4
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
Show 15 more
WARNINGMaintainabilityDirect Query2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
WARNINGMaintainabilityNo Caching2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
ERRORSecuritySQL query is not prepared2
Category
Security
Occurrences
2
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $escapedPrefix

WordPress.DB.PreparedSQL.NotPrepared
ERRORMaintainabilitycurl curl getinfo2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WordPress.WP.AlternativeFunctions.curl_curl_getinfo
WARNINGMaintainabilityNo PHP code found1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.

Internal.NoCodeFound
ERRORMaintainabilitydate date1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WordPress.DateTime.RestrictedFunctions.date_date
WARNINGMaintainabilityNon-prefixed global variable1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: &quot;$charge&quot;.

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
WARNINGMaintainabilityerror log debug backtrace1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

debug_backtrace() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace
WARNINGMaintainabilityerror log error log1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

error_log() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_error_log
WARNINGMaintainabilityerror log trigger error1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

trigger_error() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_trigger_error
WARNINGSecurityInput is not validated or sanitized1
Category
Security
Occurrences
1
Severity
warning

Sample message

Detected usage of a non-sanitized, non-validated input variable _REQUEST: &quot;Order with ID &#039;$_REQUEST[order_id]&#039; not found.&quot;

WordPress.Security.ValidatedSanitizedInput.InputNotValidatedNotSanitized
ERRORMaintainabilitycurl curl close1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WordPress.WP.AlternativeFunctions.curl_curl_close
ERRORMaintainabilitycurl curl errno1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WordPress.WP.AlternativeFunctions.curl_curl_errno
ERRORMaintainabilitycurl curl error1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WordPress.WP.AlternativeFunctions.curl_curl_error
ERRORMaintainabilitycurl curl exec1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Using cURL functions is highly discouraged. Use wp_remote_get() instead.

WordPress.WP.AlternativeFunctions.curl_curl_exec

External Connections

Potential connections found in static code analysis.

20 domains

Outbound calls

55

External assets

4

Incoming endpoints

3

Notable Domains

developer.authorize.net16 · outbound
account.authorize.net9 · outbound
authorize.net5 · outbound
support.stripe.com4 · outbound
stripe.com2 · outbound
api.authorize.net1 · outbound

Platform / Reference Domains

github.com3 · platform/reference
make.wordpress.org2 · platform/reference
wordpress.org2 · platform/reference
codex.wordpress.org1 · platform/reference

External Asset Domains

api.ewaypayments.com3 · asset + outbound
js.stripe.com2 · asset + outbound
jstest.authorize.net2 · asset + outbound
js.authorize.net1 · asset

Incoming Endpoints

No public endpoints detected.

Admin AJAX endpoints3
wp_ajax_woo_mp_get_unpaid_order_balanceauthenticated

wp_ajax

wp_ajax_woo_mp_process_transactionauthenticated

wp_ajax

wp_ajax_woo_mp_ratedauthenticated

wp_ajax

Score History

First score snapshot

v2.8.10

35

Latest

Findings
105
Errors
63
Warnings
42
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Author

bflauthor

Related

Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreWooCommerce22 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreWP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin30 scoreJetpack – WP Security, Backup, Speed, & Growth23 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreComplianz – GDPR/CCPA Cookie Consent24 scoreDuplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More21 scoreLoco Translate26 scoreMeta Box96 scorePixelYourSite – Your smart PIXEL (TAG) & API Manager24 scoreWooPayments: Integrated WooCommerce Payments30 scoreWooCommerce Tax (formerly WooCommerce Shipping & Tax)30 score

Related Plugins

Crypto Payment Gateway with Instant Payouts

1k+ active installs

100
Instant Approval Payment Gateway with Instant Payouts

2k+ active installs

100
Masks Form Fields

9k+ active installs

99
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway

600 active installs

99
BjornTech Swish for WooCommerce

2k+ active installs

98
Cash On Pickup for WooCommerce

8k+ active installs

98