Under Construction, Coming Soon & Maintenance Mode Security & Risk Analysis

The "under-construction-maintenance-mode" plugin v2.1.1 exhibits a mixed security posture. While it has no known critical vulnerabilities and boasts a lack of dangerous functions, file operations, and external HTTP requests, several concerns arise from the static analysis. The presence of two unprotected AJAX handlers significantly increases the attack surface, providing potential entry points for unauthorized actions. Furthermore, the static analysis reveals a single SQL query that does not utilize prepared statements, posing a risk of SQL injection. The output escaping is also a concern, with only 16% of outputs being properly escaped, leaving room for cross-site scripting (XSS) vulnerabilities. The plugin's vulnerability history shows two past CVEs, including one high and one medium severity, both related to Server-Side Request Forgery (SSRF). While there are no currently unpatched CVEs, this history indicates a past tendency towards exploitable flaws, particularly SSRF, which warrants careful monitoring. Overall, the plugin has some strong security foundations but requires immediate attention regarding its unprotected AJAX endpoints and SQL query handling.