CMP – Coming Soon & Maintenance Plugin by NiteoThemes Security & Risk Analysis

The "cmp-coming-soon-maintenance" v4.1.16 plugin presents a mixed security posture. On the positive side, the static analysis indicates a good effort in implementing security checks, with all AJAX handlers and REST API routes appearing to have authorization checks, and a high percentage of output escaping. The presence of numerous nonce and capability checks also suggests a developer mindful of WordPress security best practices. However, significant concerns arise from the analysis of SQL queries and taint flows. The complete lack of prepared statements for all three SQL queries is a major red flag, potentially exposing the site to SQL injection vulnerabilities. Furthermore, 13 flows with unsanitized paths detected in the taint analysis, despite no reported critical or high severity issues, suggest a potential for path traversal or file inclusion vulnerabilities that may not have been fully exposed or exploited in the analyzed context. The plugin's vulnerability history is also a significant concern. With a total of 6 known CVEs, including 2 high severity and 4 medium severity vulnerabilities, even though none are currently unpatched, it points to a history of security weaknesses. The common vulnerability types like Unrestricted Upload, SSRF, Improper Access Control, and Missing Authorization indicate recurring issues that require careful monitoring. While the current version appears to have addressed past CVEs and has a protected attack surface, the inherent risks from the SQL query practices and taint flow results, combined with its past vulnerability record, necessitate a cautious approach. The bundling of Select2 also warrants a check for its version and any known vulnerabilities.