Maintenance Switch Security & Risk Analysis

The 'maintenance-switch' plugin v1.7.1 presents a mixed security posture. On one hand, it demonstrates good practices in several areas, including the exclusive use of prepared statements for SQL queries and a high percentage of properly escaped output, indicating a developer awareness of common web vulnerabilities. The absence of dangerous functions, external HTTP requests, and taint analysis findings with unsanitized paths are also positive indicators. However, significant concerns arise from its attack surface and vulnerability history. The presence of an unprotected AJAX handler is a critical flaw, providing a direct entry point for attackers without authentication. This, coupled with a history of two medium-severity vulnerabilities, including CSRF and XSS, suggests a pattern of potential security weaknesses. The fact that one of these vulnerabilities remains unpatched is a serious concern that elevates the risk considerably.