Comprehensive Security Architecture and Automated Vulnerability Assessment for WordPress Plugins

1. Introduction to the WordPress Security Landscape

WordPress powers 40%+ of web. Paradox: hardened core + decentralized plugins = frequent critical vulns. Security engineers must identify insecure patterns before production.

2024–2025 intel: vuln reports up 34%, 96% from plugins not core. Security perimeter = weakest plugin.

Report is technical directive for building custom security scanning agent — automated auditor for WordPress plugin code. Agent needs deep semantic understanding of "WordPress Way": APIs, coding standards, architectural patterns.

Goal: decompose WordPress security model into actionable scanning logic. Cover SQLi, XSS, Phar Deserialization, Type Juggling. Define Sources (untrusted inputs) and Sinks (dangerous execution points) to track — minimize false positives, ensure full coverage.

2. Architectural Foundations of a Custom Security Scanner

Choose between Regex and AST analysis — fundamental to agent capability and accuracy.

2.1 The Limitations of Regex-Based Scanning

Regex works for simple pattern matching — finding `eval()` or `system()`. No context.

**False Positives:** Regex flags `echo $secure_variable;` as XSS because it sees `echo`, ignoring `esc_html()` upstream.
**False Negatives:** Obfuscation or unconventional styles (`$func($arg)`) bypass regex.

2.2 The Necessity of Abstract Syntax Trees (AST)

Deep Research agent requires AST. PHP source → tree structure → Taint Analysis: track data from Source to Sink.

**Data Flow Analysis:** Map `$_GET['id']` (Source) → `$id` → `$wpdb->query("... $id...")` (Sink) — no `absint()` in path.

**Context Awareness:** AST determines if function call is inside capability check conditional.

2.3 Defining Sources and Sinks in WordPress

| Category | Description | Examples (Sources/Sinks) |
|---|---|---|
| Sources | Untrusted data entry points | `$_GET`, `$_POST`, `$_REQUEST`, `$_COOKIE`, `$_SERVER`, `file_get_contents('php://input')`, `get_header()` |
| Sinks (Execution) | Code/command execution | `eval()`, `system()`, `exec()`, `passthru()`, `shell_exec()`, `call_user_func()` |
| Sinks (SQL) | DB interaction | `$wpdb->query()`, `$wpdb->get_results()`, `$wpdb->insert()`, `$wpdb->update()` |
| Sinks (Output) | Browser output | `echo`, `print`, `printf`, `vprintf`, `die()`, `exit()` |
| Sinks (File) | Filesystem writes | `file_put_contents()`, `fwrite()`, `move_uploaded_file()`, `copy()`, `unlink()` |

Agent traverses AST to find Source→Sink connections not interrupted by valid Validation or Sanitization.

3. Deep Dive: Authentication, Authorization, and Access Control

Broken Access Control tops OWASP Top 10. In WordPress, stems from misunderstood API functions. Agent must distinguish Authentication (who user is) vs Authorization (what they can do).

3.1 The is_admin() Fallacy

Pervasive critical pattern: `is_admin()` checks if current request is for admin page (URL contains `/wp-admin/`) — NOT if user is admin.

**Vulnerability:** AJAX requests go through `admin-ajax.php` (in `/wp-admin/`), so `is_admin()` returns `true` for all AJAX — including unauthenticated. Attacker hits `admin-ajax.php`, bypasses any check relying solely on `is_admin()`.

**Agent Logic:**
- Scan for logic gates protecting sensitive actions (`update_option`, `wp_delete_post`)
- Check if condition uses `is_admin()`
- If `is_admin()` only check → flag **Critical Authentication Bypass**
- Verify `current_user_can()` or `user_can()` present

3.2 Privilege Escalation and Capability Checks

Subscriber performing Administrator actions.

AJAX hooks: `wp_ajax_{action}` (authenticated) vs `wp_ajax_nopriv_{action}` (unauthenticated).

**Anti-Pattern:** Sensitive action (update site settings) under `wp_ajax_nopriv_` → immediate fail.

**Subtle Anti-Pattern:** Under `wp_ajax_` but no capability check. Logged-in Subscriber triggers `wp_ajax_` hooks. Without `current_user_can('manage_options')`, Subscriber changes site settings.

**Agent Logic:**
- Identify all `add_action` calls hooking into `wp_ajax_*`
- Trace callback function
- Assert first logical block contains `current_user_can()` check
- Map capability (`edit_posts` vs `manage_options`) to action sensitivity (`update_option` requires `manage_options`)

3.3 The Nonce System (CSRF Protection)

WordPress Nonces protect against CSRF. Valid for specific action + user within 12–24 hour window.

Without nonces, attacker tricks admin into clicking link that updates plugin settings or deletes post.

**Agent Logic:**
- **Creation:** Look for `wp_create_nonce()` or `wp_nonce_field()` in form rendering
- **Verification:** Look for `wp_verify_nonce()`, `check_admin_referer()`, `check_ajax_referer()` in form processing
- **Vulnerability:** Function processes `$_POST` data to write to DB but lacks nonce verification → flag **Missing CSRF Protection (High Severity)**
- **Advanced:** Ensure nonce uses unique action string (`delete-post_123` not generic) — prevents replay attacks across contexts

3.4 REST API Authorization: permission_callback

`register_rest_route` has critical `permission_callback` argument.

**Flaw:** Devs set `permission_callback => '__return_true'` during dev and forget, or omit entirely (defaults to open in older WP). Exposes endpoint to public internet.

**Privilege Escalation Vector:** Public endpoints modifying user data or site config → unauthenticated privilege escalation.

**Agent Logic:**
- Scan for `register_rest_route`
- Inspect args array for `permission_callback`
- Flag **Critical** if missing or `__return_true` for POST, PUT, PATCH, DELETE routes
- Verify callback performs `current_user_can` check

3.5 Insecure Direct Object References (IDOR)

App gives direct access to objects via user input without ownership verification.

**Scenario:** Plugin lets users edit profile via `admin-ajax.php?action=edit_profile&user_id=15`. Code blindly trusts `$_GET['user_id']` → User 15 changes `user_id` to `1` (Admin) → account takeover.

**Agent Logic:**
- Identify ID variables (`$post_id`, `$user_id`, `$order_id`) sourced from input
- Check if used in sensitive functions (`update_user_meta`, `wp_update_post`)
- Constraint: verify check comparing input ID against `get_current_user_id()` or capability check (`edit_others_posts`)

4. Input Lifecycle: Validation, Sanitization, and Escaping

Mantra: **"Validate Early, Sanitize Early, Escape Late"**. Agent enforces this rigorously.

4.1 Data Validation

Boolean check of input against expected format. "Is this data what it claims to be?"

**Agent Scanning Targets:**
- `is_email()`: email fields
- `is_numeric()` / `is_int()`: IDs and quantities
- `validate_file()`: checks for directory traversal chars, NOT file existence. Returns `0` if path valid (safe) — confusing for devs expecting boolean. Agent checks correct usage: `if ( validate_file( $path ) !== 0 ) { error }`

4.2 Data Sanitization

Clean input before DB storage.

**Agent Scanning Targets — map input types to required functions:**
- Text/Strings: `sanitize_text_field()` (removes tags, checks encoding)
- Rich Text: `wp_kses_post()` or `wp_kses()` (allows specific HTML tags)
- Keys/Slugs: `sanitize_key()` (lowercase alphanumeric, underscores)
- Titles: `sanitize_title()`
- SQL Order By: `sanitize_sql_orderby()` (crucial for ORDER BY injection prevention)
- Files: `sanitize_file_name()` (removes special chars from filenames)

4.3 Context-Aware Escaping (Late Escaping)

Escape at output point using correct function for context (HTML, Attribute, JS, URL).

| Context | Vulnerability | Required Function | Agent Check |
|---|---|---|---|
| HTML Body | XSS | `esc_html()`, `esc_html__()` | Check `echo` inside `<div>` or `<p>` |
| HTML Attribute | XSS (Attribute Breakout) | `esc_attr()`, `esc_attr__()` | Check `echo` inside `value="..."` or `class="..."` |
| URL | XSS (`javascript:` protocol) | `esc_url()` | Check `echo` inside `href="..."` or `src="..."` |
| JavaScript | XSS (Code Injection) | `esc_js()`, `wp_json_encode()` | Check output inside `<script>` blocks |
| Translation | XSS | `esc_html_e()`, `esc_attr_e()` | Check usage of `_e()` vs `esc_html_e()` |

5. Database Layer Security: SQL Injection and Advanced Vectors

SQLi lets attackers manipulate queries → unauthorized data access or modification. WordPress provides `$wpdb` class but improper usage widespread.

5.1 The $wpdb->prepare() Mechanism

Primary defense against SQLi. Acts like `sprintf()`, substituting placeholders (`%s`, `%d`, `%f`) with sanitized values.

**Secure Pattern:** `$wpdb->query( $wpdb->prepare( "SELECT * FROM table WHERE id = %d", $id ) );`
**Vulnerable Pattern:** `$wpdb->query( "SELECT * FROM table WHERE id = $id" );`

**Agent Logic:**
- Flag any `$wpdb->query`, `get_results`, `get_var`, `get_row` etc. where SQL string built via concatenation (`.`) or variable interpolation (`"SELECT... $var"`)
- Verify `prepare()` called before execution
- **Deep Check:** Passing variable directly as query string (`$wpdb->prepare($query)`) without placeholders still vulnerable if `$query` contains user input

5.2 Advanced SQLi Vectors

**ORDER BY Injection:** `%s` in `prepare()` wraps values in quotes (`'value'`), breaking `ORDER BY`. Devs bypass `prepare()` here → injection.
- Remediation: whitelist allowed columns or `sanitize_sql_orderby()`
- **Agent Logic:** Scan SQL strings containing `ORDER BY`, check if column name is variable, trace to whitelist check

**LIKE Wildcard Injection:** Standard escaping doesn't escape `%` and `_`. Attacker crafts expensive queries → DoS.
- Remediation: `$wpdb->esc_like()` on input before `prepare()`
- **Agent Logic:** Scan `LIKE` clauses, verify input passes through `esc_like()`

**IN Clause Injection:** `prepare()` doesn't handle arrays for `IN` clauses (`WHERE id IN (1, 2, 3)`).
- Remediation: `implode( ',', array_map( 'intval', $ids ) )`
- **Agent Logic:** Detect `IN` clauses using variables, verify constructed safely via `intval` mapping or `esc_sql` on individual elements

5.3 Charset and SQL Modes

**Charset Issues:** Specific charsets allow SQLi via multi-byte characters. WordPress handles via `DB_CHARSET` — agent checks if plugin manually changes charset connection.

**SQL Modes:** Plugins disabling `STRICT_TRANS_TABLES` weaken DB integrity checks.

6. PHP-Specific Vulnerabilities: Serialization, Type Juggling, and Logic

PHP idiosyncrasies introduce unique attack vectors.

6.1 PHP Object Injection (POI)

Critical vuln from `unserialize()` on untrusted data.

**Mechanism:** Attacker controls string passed to `unserialize()` → instantiates arbitrary PHP objects. If app or any active plugin has class with magic method (`__destruct`, `__wakeup`, `__toString`) performing dangerous actions → "Property Oriented Programming" (POP) chain → RCE.

**Agent Logic:**
- **Sink:** `unserialize()`
- **Source:** Any user input (`$_POST`, `$_COOKIE`, database values that might be user-controlled)
- **Rule:** Flag any `unserialize()` on non-hardcoded data
- **Remediation:** Use `json_encode()`/`json_decode()`. If serialization mandatory, use `maybe_unserialize()` (WordPress wrapper) or PHP 7.0+ `unserialize($data, ['allowed_classes' => false])`

6.2 Phar Deserialization

File system operations trigger deserialization.

**Mechanism:** `phar://` stream wrapper allows accessing files inside PHP Archive. Accessing `file_exists('phar://path/to/file.phar')` auto-deserializes Phar manifest metadata — bypasses explicit `unserialize()`.

**Agent Logic:**
- Identify file system sinks: `file_exists`, `fopen`, `file_get_contents`, `is_dir`, `stat`, `unlink`
- Check if path argument is user-controlled
- **Risk:** Attacker uploads file (even `.jpg`), tricks app into passing path (prepended with `phar://`) to file function → RCE
- **Mitigation:** PHP 8.0+ (disabled by default) or strict path validation blocking stream wrappers

6.3 PHP Type Juggling

PHP loose comparison (`==`) performs type coercion → logic bypasses.

**Mechanism:** `if ($password == $hash)` where `$password` is integer `0` and `$hash` starts with non-numeric chars → `true`.

**Magic Hashes:** Strings starting with `0e` + digits treated as scientific notation (0^X = 0). `0e1234 == 0e5678` → `true`.

**Agent Logic:**
- Scan for `==` or `!=` comparisons involving sensitive data (hashes, tokens, passwords)
- Suggest replacing with `===` / `!==` or `hash_equals()` for timing-attack safe comparison

7. File System Integrity: Uploads, Inclusion, and Traversal

Single flaw here often leads to immediate server compromise.

7.1 Unrestricted File Uploads

Allowing user uploads without perfect handling → direct RCE path.

**Vulnerability:** Attacker uploads PHP script (`shell.php`) disguised as image.

**Common Mistakes:**
- Checking `$_FILES['file']['type']` (MIME type): user-supplied, easily spoofed
- Blacklisting extensions: attackers use `.php5`, `.phtml`, or double extensions (`shell.php.jpg`) on misconfigured servers

**Agent Logic:**
- Detect `move_uploaded_file()` usage
- **Recommendation:** Enforce `wp_handle_upload()` — performs robust checks on size, MIME type (server-side detection), extensions
- **Advanced Check:** Ensure `mimes` parameter in `wp_handle_upload` restricted to safe types (images only)

7.2 Local File Inclusion (LFI) and Directory Traversal

LFI lets attackers read or execute server files.

**Mechanism:** `include( plugin_dir_path(__FILE__). $_GET['page']. '.php' );` → attacker uses `../../wp-config` to traverse directories and load sensitive files.

**Agent Logic:**
- **Sinks:** `include`, `require`, `include_once`, `require_once`
- **Detection:** Flag any inclusion where path concatenated with user input
- **Validation Check:** Look for `validate_file()` (returns `0` on success) or strict whitelisting (`in_array`) before inclusion
- **Zip Extraction:** Ensure plugin uses modern WP filesystem APIs for archive handling

8. Client-Side Security: XSS, Gutenberg, and UI Attacks

Gutenberg (React-based) makes client-side security more complex.

8.1 Cross-Site Scripting (XSS) Patterns

- **Reflected XSS:** Immediate via URL params. Agent looks for `echo $_GET['q']`
- **Stored XSS:** Malicious scripts saved in DB. Agent looks for `echo $post->post_title` without escaping
- **DOM-based XSS:** Client-side JS vulns. Agent scans `.js` files for `innerHTML`, `document.write`, `location.hash` without sanitization

8.2 Gutenberg and React Security

React escapes JSX by default. `dangerouslySetInnerHTML` is escape hatch with massive risk.

**Vulnerability:** `<div dangerouslySetInnerHTML={{__html: userContent}} />` renders raw HTML → XSS.

**Agent Logic:**
- Scan all JS/JSX files for `dangerouslySetInnerHTML`
- **Verification:** Ensure data sanitized via `DOMPurify` or `wp.sce.trustAsHtml` (if available in context)
- **Attribute Injection:** React attributes also vulnerable if `javascript:` URIs allowed

8.3 Open Redirects

Attacker leverages site trust to redirect users to phishing pages.

**Mechanism:** `wp_redirect( $_GET['url'] );`

**Agent Logic:**
- Scan for `wp_redirect`
- Check if argument is user-controlled
- **Remediation:** Enforce `wp_safe_redirect()` — restricts to local domain + allowed hosts whitelist

9. Network and API Security: SSRF, REST, and Redirects

9.1 Server-Side Request Forgery (SSRF)

Attacker uses WordPress server as proxy to attack internal networks or cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/).

**Mechanism:** Plugins fetch remote URLs for RSS feeds or image downloading: `wp_remote_get($_GET['url'])`.

**Agent Logic:**
- **Sinks:** `wp_remote_get`, `wp_remote_post`, `wp_remote_request`, `curl_exec`, `file_get_contents` (with URL)
- **Detection:** Flag usage where URL comes from input
- **Remediation:** Use `wp_safe_remote_get()` — auto-blocks private IP ranges and loopback addresses

10. The Agent's Scanning Rulebook: Signatures and Heuristics

10.1 Vulnerability Signatures Table

| ID | Vulnerability Type | Detection Pattern / Logic | Severity |
|---|---|---|---|
| VULN-SQL-01 | SQL Injection (Raw Query) | Sink: `$wpdb->query`, `get_results`, `get_var`. Logic: argument contains variable concatenation or double-quote interpolation. | Critical |
| VULN-SQL-02 | SQL Injection (Prepared) | Sink: `$wpdb->prepare`. Logic: first argument is variable (not string literal). | High |
| VULN-SQL-03 | SQL Injection (Order By) | Sink: query string contains `ORDER BY`. Logic: column/direction is dynamic variable AND NOT sanitized via `sanitize_sql_orderby` or whitelist. | High |
| VULN-XSS-01 | Reflected XSS | Sink: `echo`, `print`, `printf`. Source: `$_GET`, `$_POST`. Logic: no escaping function (`esc_*`) in path. | High |
| VULN-XSS-02 | Stored XSS | Sink: `echo`. Source: DB output (`get_option`, etc.). Logic: no escaping function. | High |
| VULN-CSRF-01 | Missing Nonce | Context: `wp_ajax_*` or `admin_post_*` hook. Logic: function body lacks `check_admin_referer` or `wp_verify_nonce`. | High |
| VULN-AUTH-01 | Privilege Escalation | Context: `wp_ajax_*` hook. Logic: function body lacks `current_user_can`. | Critical |
| VULN-AUTH-02 | Insecure Admin Check | Logic: sensitive action gated only by `is_admin()`. | Critical |
| VULN-POI-01 | Object Injection | Sink: `unserialize`. Source: untrusted input. | Critical |
| VULN-FILE-01 | Unsafe Upload | Sink: `move_uploaded_file`. Logic: `wp_handle_upload` not used. | Critical |
| VULN-SSRF-01 | Unsafe Remote Request | Sink: `wp_remote_get`. Source: untrusted URL. Remediation: use `wp_safe_remote_get`. | Medium |
| VULN-REST-01 | Open REST Endpoint | Context: `register_rest_route`. Logic: `permission_callback` missing or `__return_true`. | High |
| VULN-REACT-01 | Dangerous HTML | Context: JS/JSX files. Pattern: `dangerouslySetInnerHTML` without sanitizer. | High |

10.2 Workflow for the Agent

**Preparation Phase:**
- Identify Plugin Slug and Version
- Download source to sandbox
- Run `composer install` to check `composer.lock` for vulnerable libraries

**Static Analysis Phase (SAST):**
- **AST Parsing:** Use PHP parser (`nikic/php-parser` or PHPCS engine) to generate AST
- **Taint Tracking:** Map all Sources to Sinks
- **Context Verification:** Check for sanitizers/validators in data path
- **Config Check:** Scan `wp-config.php` patterns or `php.ini` dependencies (`allow_url_fopen`)

**Heuristic Analysis Phase:**
- Check "Code Smells": hardcoded credentials, debug functions (`print_r`, `var_dump`) in production, commented-out security checks
- **False Positive Reduction:** Apply Confidence Scores. Custom function named `my_plugin_sanitize_...` → lower confidence, still report for manual review

11. Operational Workflow: CI/CD Integration and False Positive Management

11.1 CI/CD Pipeline Integration

Deploy agent as CI pipeline step (GitHub Actions, GitLab CI, Jenkins).

- **Trigger:** Run on every PR and merge to main
- **Gating:** Fail build on High or Critical findings
- **Automated Testing:** Combine SAST with PHPUnit (unit tests) and Playwright (E2E) to verify security patches don't break functionality

11.2 Managing False Positives

- **Baseline/Suppression:** Allow devs to flag findings via code comments (`// phpcs:ignore WordPress.Security.EscapeOutput -- Logic verified manual escaping`)
- **Contextual Intelligence:** If variable checked via `in_array($var, $whitelist)`, agent recognizes valid validation → suppress XSS/SQLi warning for that variable
- **Confidence Levels:** Categorize findings: Certain, Firm, Tentative. Block only on "Certain" to prevent pipeline congestion

11.3 Remediation Workflow

When agent detects flaw:
- **Report:** File, line number, vuln type, code snippet
- **Educational Context:** Link to WordPress function docs (e.g., `wp_nonce_field` docs) to teach correct pattern
- **Suggested Fix:** Generate diff showing insecure vs secure code (e.g., replacing `$_POST['id']` with `absint($_POST['id'])`)

12. Conclusion

Securing WordPress plugins requires shift from reactive patching to proactive architectural security. Custom agent understanding WordPress API nuances — `prepare()` SQL handling, `permission_callback` in REST routes — creates robust defense against prevalent web attacks.

Enforcing early validation, strict sanitization, context-aware escaping, integrated into automated pipelines — WordPress ecosystem hardens one plugin at a time. Agent is not just scanner; it's enforcer of "WordPress Way": CMS flexibility without security cost.

Works cited

WordPress Vulnerabilities Database 2025: Complete Security Intelligence Guide, accessed December 15, 2025, https://wpsecurityninja.com/wordpress-vulnerabilities-database/
State of WordPress Security 2025 - Patchstack, accessed December 15, 2025, https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/
False Positives and Tuning :: CRS Documentation, accessed December 15, 2025, https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/
What is static analysis? - Blog - Secure Code Warrior, accessed December 15, 2025, https://www.securecodewarrior.com/article/what-is-static-analysis
Why use ast syntax tree modification instead of regex replacement? - Stack Overflow, accessed December 15, 2025, https://stackoverflow.com/questions/72017024/why-use-ast-syntax-tree-modification-instead-of-regex-replacement
What it takes to build a Static Analysis tool - DEV Community, accessed December 15, 2025, https://dev.to/antoinecoulon/what-it-takes-to-build-a-static-analysis-tool-4p40
Using OWASP Top 10 to improve WordPress security - Melapress, accessed December 15, 2025, https://melapress.com/owasp-wordpress-security-top-10/
What is OWASP? What is the OWASP Top 10? - Cloudflare, accessed December 15, 2025, https://www.cloudflare.com/learning/security/threats/owasp-top-10/
is_admin() – Function - WordPress Developer Resources, accessed December 15, 2025, https://developer.wordpress.org/reference/functions/is_admin/
2.3: How to Prevent Authentication Bypass Vulnerabilities - Wordfence, accessed December 15, 2025, https://www.wordfence.com/learn/how-to-prevent-authentication-bypass-attacks/
I found 300+ vulnerabilities in WordPress plugins, Ask Me Anything! - Reddit, accessed December 15, 2025, https://www.reddit.com/r/Wordpress/comments/1elie04/i_found_300_vulnerabilities_in_wordpress_plugins/
AI Engine WordPress Plugin CVE-2025-11749: Brief Summary of Sensitive Information Exposure and Privilege Escalation - ZeroPath Blog, accessed December 15, 2025, https://zeropath.com/blog/cve-2025-11749-ai-engine-wordpress-plugin
What is WordPress Privilege Escalation? - MalCare, accessed December 15, 2025, https://www.malcare.com/blog/wordpress-privilege-escalation/
What is Nonce Verification in WordPress? - GreenGeeks, accessed December 15, 2025, https://www.greengeeks.com/glossary/nonce-verification/
How to Secure Your WordPress Plugin AJAX Endpoints - Voxfor, accessed December 15, 2025, https://www.voxfor.com/how-to-secure-your-wordpress-plugin-ajax-endpoints/
WordPress Plugin Developers Need to Make Sure Their Nonce Checks Both Work if a Nonce Isn't Sent or if the Nonce is Wrong - Plugin Vulnerabilities, accessed December 15, 2025, https://www.pluginvulnerabilities.com/2024/01/24/wordpress-plugin-developers-need-to-make-sure-there-nonce-checks-both-work-if-a-nonce-isnt-sent-or-if-the-nonce-is-wrong/
An Introduction to WordPress Nonces with Examples - Elegant Themes, accessed December 15, 2025, https://www.elegantthemes.com/blog/tips-tricks/an-introduction-to-wordpress-nonces-with-examples
WordPress REST API – custom routes & endpoints, accessed December 15, 2025, https://learn.wordpress.org/tutorial/wordpress-rest-api-custom-routes-endpoints/
Backdoor Code Routes Malicious Actions Through WordPress REST API, accessed December 15, 2025, https://www.pluginvulnerabilities.com/2025/02/20/backdoor-code-routes-malicious-actions-through-wordpress-rest-api/
WordPress bSecure Plugin CVE-2025-6187: Privilege Escalation via REST API Authorization Flaw - ZeroPath Blog, accessed December 15, 2025, https://zeropath.com/blog/cve-2025-6187-bsecure-wordpress-privilege-escalation
Fix IDOR Vulnerability in WordPress: 7 Effective Ways - Pentest Testing Corp, accessed December 15, 2025, https://www.pentesttesting.com/fix-idor-vulnerability-in-wordpress/
Validating, sanitizing, and escaping - WordPress VIP Documentation, accessed December 15, 2025, https://docs.wpvip.com/security/validating-sanitizing-and-escaping/
Data Validation and Sanitization in WordPress - DEV Community, accessed December 15, 2025, https://dev.to/gp-webdev/data-validation-and-sanitization-in-wordpress-3on9
Sanitizing, Escaping and Validating Data in WordPress - SitePoint, accessed December 15, 2025, https://www.sitepoint.com/sanitizing-escaping-validating-data-in-wordpress/
Use wpdb->prepare for `order by` column name - WordPress Development Stack Exchange, accessed December 15, 2025, https://wordpress.stackexchange.com/questions/138976/use-wpdb-prepare-for-order-by-column-name
Security Functions - Engineering Handbook, accessed December 15, 2025, https://engineering.hmn.md/guides/wordpress/security-functions/
How to Prevent SQL Injection in WordPress - Skynats, accessed December 15, 2025, https://www.skynats.com/blog/how-to-prevent-sql-injection-in-wordpress/
SQL Injection: A Detailed Guide for WordPress Users - Kinsta®, accessed December 15, 2025, https://kinsta.com/blog/sql-injection/
How To Find SQL Injection Vulnerabilities in WordPress Plugins and Themes - Wordfence, accessed December 15, 2025, https://www.wordfence.com/blog/2025/08/how-to-find-sql-injection-vulnerabilities-in-wordpress-plugins-and-themes/
wpdb – Class - WordPress Developer Resources, accessed December 15, 2025, https://developer.wordpress.org/reference/classes/wpdb/
The Vital Role of $wpdb->prepare() in WordPress - Koddr.io Blog, accessed December 15, 2025, https://blog.koddr.io/importance-wpdb-prepare-wordpress/
How to Prevent SQL Injection Attacks in WordPress (7 Steps) - Comodo SSL Certificate, accessed December 15, 2025, https://comodosslstore.com/blog/how-to-prevent-sql-injection-attacks-in-wordpress-7-steps.html
PHP unserialize() Deserialization Vulnerability | Security Vulnerability Database - Sourcery, accessed December 15, 2025, https://sourcery.ai/vulnerabilities/php-lang-security-unserialize-use
Learn about PHP Object Injection - Patchstack, accessed December 15, 2025, https://patchstack.com/academy/wordpress/vulnerabilities/php-object-injection/
600,000 WordPress Sites Affected by PHP Object Injection Vulnerability in Fluent Forms WordPress Plugin - Wordfence, accessed December 15, 2025, https://www.wordfence.com/blog/2025/09/600000-wordpress-sites-affected-by-php-object-injection-vulnerability-in-fluent-forms-wordpress-plugin/
WordPress Plugin String locator PHAR Deserialization (2.5.0) - Vulnerabilities - Acunetix, accessed December 15, 2025, https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-string-locator-phar-deserialization-2-5-0/
New PHP Code Execution Attack Puts WordPress Sites at Risk - The Hacker News, accessed December 15, 2025, https://thehackernews.com/2018/08/php-deserialization-wordpress.html
PHP Phar Remote Code Execution Vulnerability - NHS England Digital, accessed December 15, 2025, https://digital.nhs.uk/cyber-alerts/2018/cc-2623
Uncovering a PHAR Deserialization Vulnerability in WP Meta SEO and Escalating to RCE, accessed December 15, 2025, https://wpscan.com/blog/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/
PHP Type Juggling Simplified - The SecOps Group, accessed December 15, 2025, https://secops.group/php-type-juggling-simplified/
PHP Type Juggling Vulnerabilities & How to Fix Them - Invicti, accessed December 15, 2025, https://www.invicti.com/blog/web-security/php-type-juggling-vulnerabilities
Ehxb | File Upload Vulnerabilities I - InfoSec Write-ups, accessed December 15, 2025, https://infosecwriteups.com/ehxb-file-upload-vulnerabilities-i-6ed033539682
File Upload Bypass: Upload Forms Threat Explained - Acunetix, accessed December 15, 2025, https://www.acunetix.com/websitesecurity/upload-forms-threat/
How to prevent every malicious file upload on my server? (check file type)? - Stack Overflow, accessed December 15, 2025, https://stackoverflow.com/questions/690108/how-to-prevent-every-malicious-file-upload-on-my-server-check-file-type
File upload security/attacks? : r/PHP - Reddit, accessed December 15, 2025, https://www.reddit.com/r/PHP/comments/lb2lq/file_upload_securityattacks/
wp_handle_upload WordPress function - WPTurbo, accessed December 15, 2025, https://wpturbo.dev/functions/wp_handle_upload/
How to Handle File Uploads in WordPress | Reintech media, accessed December 15, 2025, https://reintech.io/blog/handling-file-uploads-wordpress
Unrestricted File Upload in WordPress: 10 Proven Fixes, accessed December 15, 2025, https://www.pentesttesting.com/unrestricted-file-upload-in-wordpress/
What is Directory Traversal? - SolidWP, accessed December 15, 2025, https://solidwp.com/blog/what-is-directory-traversal/
WordPress Directory Traversal Attack - Beagle Security, accessed December 15, 2025, https://beaglesecurity.com/blog/vulnerability/wordpress-plugin-directory-traversal.html
Using dangerouslySetInnerHTML Safely in React and Next.js Production Systems, accessed December 15, 2025, https://dev.to/hijazi313/using-dangerouslysetinnerhtml-safely-in-react-and-nextjs-production-systems-115n
Security Best Practices for WordPress Block Development - rtCamp, accessed December 15, 2025, https://rtcamp.com/handbook/developing-for-block-editor-and-site-editor/security/
How to prevent XSS attacks when using dangerouslySetInnerHTML in React | by Jam3, accessed December 15, 2025, https://medium.com/@Jam3/how-to-prevent-xss-attacks-when-using-dangerouslysetinnerhtml-in-react-f669f778cebb
Learn about Open Redirect - Patchstack, accessed December 15, 2025, https://patchstack.com/academy/wordpress/vulnerabilities/open-redirect/
WordPress Open Redirect - Beagle Security, accessed December 15, 2025, https://beaglesecurity.com/blog/vulnerability/wordpress-open-redirect.html
Open Redirect Vulnerability: How It Works & How to Prevent It - StackHawk, accessed December 15, 2025, https://www.stackhawk.com/blog/what-is-open-redirect/
WordPress Server-Side Request Forgery (SSRF) Vulnerability 2024 - WP Hacked Help, accessed December 15, 2025, https://secure.wphackedhelp.com/blog/wordpress-ssrf-vulnerability/amp/
wp_safe_remote_get() – Function - WordPress Developer Resources, accessed December 15, 2025, https://developer.wordpress.org/reference/functions/wp_safe_remote_get/
Fix SSRF Vulnerability in WordPress: 7 Effective Ways - Pentest Testing Corp, accessed December 15, 2025, https://www.pentesttesting.com/ssrf-vulnerability-in-wordpress/
A06 Vulnerable and Outdated Components - OWASP Top 10:2021, accessed December 15, 2025, https://owasp.org/Top10/2021/A06_2021-Vulnerable_and_Outdated_Components/
False Positives and False Negatives with Container Images Scanners - Chainguard Academy, accessed December 15, 2025, https://edu.chainguard.dev/chainguard/chainguard-images/staying-secure/working-with-scanners/false-results/
How to Cut Through DAST False Positives and Prioritize Real Risks - Invicti, accessed December 15, 2025, https://www.invicti.com/blog/web-security/reduce-dast-false-positives
Create a Robust CI/CD Workflow for WordPress | Pantheon.io, accessed December 15, 2025, https://pantheon.io/learning-center/wordpress/ci-cd
ACF | WordPress Automated Testing for Developers, accessed December 15, 2025, https://www.advancedcustomfields.com/blog/wordpress-automated-testing/
Automated testing and Continuous Integration in WordPress development - Kinsta, accessed December 15, 2025, https://kinsta.com/blog/automated-testing/