PublishPress Statuses – Custom Post Status and Workflow Security & Risk Analysis

The PublishPress Statuses plugin v1.2.4 exhibits a generally positive security posture, with a strong emphasis on output escaping and a significant number of capability checks. The absence of known CVEs and taint analysis findings indicates good development practices regarding common vulnerability types. However, the presence of two unprotected AJAX handlers represents a notable concern. These entry points, without proper authentication or authorization checks, could be exploited by attackers to perform unintended actions or access sensitive data. While the majority of SQL queries use prepared statements, and there are no indications of dangerous functions or file operations, these unprotected AJAX endpoints remain a significant weakness in an otherwise well-secured plugin.