Maintenance Mode with Site Build Status Security & Risk Analysis

The "maintenance-mode-with-site-build-status" plugin v1.0.9 exhibits a mixed security posture. On the positive side, it demonstrates good practices by avoiding dangerous functions, performing all SQL queries using prepared statements, and having no recorded vulnerability history or critical taint flows. The presence of nonce and capability checks, while limited, also indicates some attention to security.

However, significant concerns arise from the static analysis. The plugin has a single identified entry point, an AJAX handler, which critically lacks any authentication checks. This unprotected entry point represents a direct avenue for potential unauthorized access or manipulation. Furthermore, a substantial portion of its output is not properly escaped, creating a risk of cross-site scripting (XSS) vulnerabilities if user-supplied data is reflected directly in the output without sanitization.

While the plugin has no known CVEs, the lack of authentication on its sole AJAX handler is a serious omission that outweighs the positive aspects. This plugin is not recommended for production use without immediate remediation of the unauthenticated AJAX handler and output escaping issues.