Coming Soon Maintenance Mode Security & Risk Analysis

The "coming-soon-maintenance-mode" plugin v1.1.5 exhibits a mixed security posture. On the positive side, it demonstrates good coding practices by using prepared statements for all SQL queries, properly escaping all outputs, and avoiding dangerous functions or file operations. The absence of critical or high-severity taint flows, along with no unpatched CVEs, is also encouraging. However, a significant concern is the presence of one unprotected AJAX handler, representing a direct entry point for potential unauthorized actions if exploited. The plugin's vulnerability history, while currently clear of unpatched issues, has previously seen a medium-severity vulnerability related to improper access control, suggesting that access control mechanisms require diligent review. The plugin has a moderate attack surface with 9 AJAX handlers, and while most are protected, the single unprotected handler remains a notable weakness.