Static Cache Wrangler Security & Risk Analysis

wordpress.org/plugins/static-cache-wrangler

Export your WordPress site as a static HTML website — fast, secure, and offline-ready with WP-CLI support.

10 active installs v2.1.6 PHP 7.4+ WP 5.0+ Updated Mar 19, 2026
cachehtml-exportstatic-sitestatic-site-exportstatic-site-generator
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Static Cache Wrangler Safe to Use in 2026?

Generally Safe

Score 100/100

Static Cache Wrangler has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 2mo ago
Risk Assessment

The "static-cache-wrangler" plugin v2.1.6 demonstrates a generally good security posture with several strengths. The code analysis reveals a low attack surface, with only one entry point identified. Critically, this single entry point is an AJAX handler that lacks authentication checks, presenting a significant security concern. While dangerous functions are absent and SQL queries are handled securely with prepared statements, the lack of authorization on an AJAX endpoint leaves it vulnerable to unauthorized actions by unauthenticated users. The plugin also shows excellent output escaping and a good number of capability checks, indicating developer attention to preventing common vulnerabilities.

Key Concerns

  • AJAX handler without auth checks
Vulnerabilities
None known

Static Cache Wrangler Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

Static Cache Wrangler Release Timeline

v2.1.6Current
v2.1.5
v2.1.4
v2.1.3
v2.1.2
v2.1.1
v2.1.0
v2.0.7
v2.0.6
Code Analysis
Analyzed Apr 16, 2026

Static Cache Wrangler Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
2
134 escaped
Nonce Checks
4
Capability Checks
9
File Operations
2
External Requests
1
Bundled Libraries
0

Output Escaping

99% escaped136 total outputs
Data Flows · Security
All sanitized

Data Flow Analysis

2 flows
handle_toggle (admin/class-stcw-admin.php:123)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

Static Cache Wrangler Attack Surface

Entry Points1
Unprotected1

AJAX Handlers 1

authwp_ajax_stcw_process_pendingincludes/class-stcw-core.php:45
WordPress Hooks 13
actionadmin_bar_menuadmin/class-stcw-admin-bar.php:19
actionwp_enqueue_scriptsadmin/class-stcw-admin-bar.php:20
actionadmin_enqueue_scriptsadmin/class-stcw-admin-bar.php:21
actionadmin_menuadmin/class-stcw-admin.php:22
actionadmin_post_stcw_toggleadmin/class-stcw-admin.php:23
actionadmin_post_stcw_clearadmin/class-stcw-admin.php:24
actionadmin_post_stcw_downloadadmin/class-stcw-admin.php:25
actionadmin_enqueue_scriptsadmin/class-stcw-admin.php:26
actionwpincludes/class-stcw-core.php:41
actionstcw_process_assetsincludes/class-stcw-core.php:42
actionadmin_footerincludes/class-stcw-core.php:48
actionwp_footerincludes/class-stcw-core.php:49
actionplugins_loadedstatic-site.php:191

Scheduled Events 3

stcw_process_assets
stcw_process_assets
stcw_process_assets
Maintenance & Trust

Static Cache Wrangler Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 19, 2026
PHP min version7.4
Downloads602

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

Static Cache Wrangler Developer Profile

derickschaefer

6 plugins · 40 total installs

89
trust score
Avg Security Score
93/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Static Cache Wrangler

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/static-cache-wrangler/admin/js/stcw-admin-bar-handler.js
Script Paths
/wp-content/plugins/static-cache-wrangler/admin/js/stcw-admin-bar-handler.js
Version Parameters
static-cache-wrangler/admin/js/stcw-admin-bar-handler.js?ver=

HTML / DOM Fingerprints

FAQ

Frequently Asked Questions about Static Cache Wrangler