No Gutenberg – Disable Blocks Editor and Global Styles – Back to Classic Editor Security & Risk Analysis

The "no-gutenberg" plugin v2.1.1 demonstrates a generally strong security posture based on the static analysis. The absence of SQL queries not using prepared statements, no file operations, and no external HTTP requests are positive indicators. The presence of a nonce check on the single AJAX handler, while lacking a capability check, suggests an attempt at basic security for its entry point. The total lack of recorded vulnerabilities and CVEs further contributes to a favorable assessment.

However, there are areas for improvement. The most significant concern is the low percentage of properly escaped output (33%). This indicates that a substantial portion of dynamically generated content might be vulnerable to Cross-Site Scripting (XSS) attacks if user-supplied data is not adequately sanitized before being displayed. While the attack surface is small and the single AJAX handler has a nonce check, the absence of a capability check leaves this entry point potentially exploitable by authenticated users with lower privileges who shouldn't have access.

Overall, the plugin has a solid foundation with its secure handling of data and absence of past vulnerabilities. The primary weakness lies in output escaping, which is a common attack vector. Addressing the unescaped output and implementing capability checks on the AJAX handler would significantly enhance its security.