Coming Soon Counter Page / Maintenance Mode – Lacoming Soon Security & Risk Analysis

The plugin "coming-soon-counter-page-maintenance-mode-lacoming-soon" v1.0.0 exhibits a mixed security posture. On the positive side, it demonstrates good practices by utilizing prepared statements for all SQL queries and a high percentage of properly escaped output. The absence of dangerous functions, file operations, and external HTTP requests, coupled with a single nonce check, are also strengths. The vulnerability history is notably clean, with no recorded CVEs, which suggests a degree of developer diligence. However, a significant concern arises from the attack surface. The plugin exposes two AJAX handlers, both of which lack authentication checks. This is a critical weakness as it allows any user, including unauthenticated ones, to potentially interact with these endpoints and trigger unintended actions. While the taint analysis shows only one flow with an unsanitized path and no critical or high severity issues, the lack of authentication on the AJAX endpoints means that even low-severity taint flows could be exploited by an unauthenticated attacker. The presence of bundled libraries like Select2, while common, could also be a minor concern if not kept up-to-date, though no specific version issues are indicated here.