Comprehensive Security Architecture and Automated Vulnerability Assessment for WordPress Plugins
1. Introduction to the WordPress Security Landscape
The WordPress ecosystem, powering over 40% of the web, represents a unique paradox in cybersecurity: a robust, continuously hardened core platform extended by a vast, decentralized library of third-party plugins that frequently introduce critical vulnerabilities. For security engineers and developers tasked with safeguarding this environment, the challenge is not merely patching known bugs but systematically identifying and mitigating insecure coding patterns before they reach production.
Recent intelligence from 2024 and 2025 indicates a significant escalation in the threat landscape. Vulnerability reports have surged by 34%, with a staggering 96% of these security flaws originating within plugins rather than the WordPress core.1 The implications are clear: the security perimeter of a WordPress installation is defined almost entirely by the quality of its weakest plugin.
This report serves as a comprehensive technical directive for constructing a custom security scanning agent—an automated auditor designed to scrutinize WordPress plugin code for security flaws. Unlike generic static analysis tools, this agent must possess a deep, semantic understanding of the "WordPress Way"—the specific APIs, coding standards, and architectural patterns that define secure development within the CMS.
The objective of this research is to decompose the security model of WordPress into actionable scanning logic. We will explore the theoretical mechanisms of vulnerabilities ranging from SQL Injection (SQLi) and Cross-Site Scripting (XSS) to esoteric PHP specificities like Phar Deserialization and Type Juggling. Furthermore, we will define the specific "Sources" (untrusted inputs) and "Sinks" (dangerous execution points) that the agent must track to effectively detect vulnerabilities, minimizing false positives while ensuring exhaustive coverage.
2. Architectural Foundations of a Custom Security Scanner
To build an effective scanning agent, one must first choose the underlying technology for code analysis. The choice between Regular Expression (Regex) matching and Abstract Syntax Tree (AST) analysis is fundamental to the agent's capability and accuracy.
2.1 The Limitations of Regex-Based Scanning
Regular expressions are effective for simple pattern matching—identifying the presence of a specific function call like eval() or system(). However, simple text matching lacks context. A regex cannot easily distinguish between a variable that was sanitized five lines prior and one that is raw user input.
False Positives: A regex might flag echo $secure_variable; as an XSS vulnerability simply because it sees an echo statement, ignoring the fact that $secure_variable was passed through esc_html() in a previous conditional block.3
False Negatives: Complex obfuscation or unconventional coding styles (e.g., variable function calls $func($arg)) often bypass regex filters entirely.4
2.2 The Necessity of Abstract Syntax Trees (AST)
For a "Deep Research" agent, AST analysis is required. An AST parser converts the PHP source code into a tree structure that represents the syntactic structure of the code.5 This allows the agent to perform Taint Analysis—tracking the flow of data from a "Source" to a "Sink".
Data Flow Analysis: The agent can map identifying that $_GET['id'] (Source) is assigned to $id, which is then passed to $wpdb->query("... $id...") (Sink) without passing through a sanitizer like absint() in between.
Context Awareness: An AST can determine if a function call is inside a conditional block that checks for user capabilities, thereby validating access control logic.6
2.3 Defining Sources and Sinks in WordPress
The core logic of the agent relies on a predefined list of Sources and Sinks specific to WordPress.
Category
Description
Examples (Sources/Sinks)
Sources
Entry points for untrusted data.
$_GET, $_POST, $_REQUEST, $_COOKIE, $_SERVER, file_get_contents('php://input'), get_header().
Sinks (Execution)
Functions that execute code or commands.
eval(), system(), exec(), passthru(), shell_exec(), call_user_func().
Sinks (SQL)
Functions that interact with the database.
$wpdb->query(), $wpdb->get_results(), $wpdb->insert(), $wpdb->update().
Sinks (Output)
Functions that send data to the browser.
echo, print, printf, vprintf, die(), exit().
Sinks (File)
Functions that write to the filesystem.
file_put_contents(), fwrite(), move_uploaded_file(), copy(), unlink().

The agent's workflow involves traversing the AST to find connections between these Sources and Sinks that are not interrupted by a valid Validation or Sanitization step.
3. Deep Dive: Authentication, Authorization, and Access Control
Broken Access Control remains a top vulnerability in the OWASP Top 10, and in WordPress, it frequently manifests through misunderstood API functions.7 The scanning agent must be trained to recognize the subtle difference between checking who a user is (Authentication) and what they are allowed to do (Authorization).
3.1 The is_admin() Fallacy
A pervasive critical vulnerability pattern involves the misuse of is_admin(). Developers often mistake this function for a capability check, assuming it verifies that the user is an administrator. In reality, is_admin() simply checks if the current request is for an administration page (i.e., the URL contains /wp-admin/).9
The Vulnerability: Since AJAX requests in WordPress are processed through admin-ajax.php (which resides in the /wp-admin/ directory), is_admin() returns true for all AJAX requests, regardless of the user's privilege level. An unauthenticated attacker sending a request to admin-ajax.php will bypass any security check relying solely on is_admin().10
Agent Logic:
Scan for logic gates protecting sensitive actions (e.g., update_option, wp_delete_post).
Check if the condition uses is_admin().
If is_admin() is the only check, flag as Critical Authentication Bypass.
Verify presence of current_user_can() or user_can().
3.2 Privilege Escalation and Capability Checks
Privilege escalation occurs when a user with lower privileges (e.g., a Subscriber) can perform actions reserved for higher privileges (e.g., an Administrator).
AJAX Hooks: WordPress separates AJAX handlers into wp_ajax_{action} (authenticated users) and wp_ajax_nopriv_{action} (unauthenticated users).
Anti-Pattern: Registering a sensitive action (like updating site settings) under wp_ajax_nopriv_ is an immediate fail.
Subtle Anti-Pattern: Registering under wp_ajax_ but failing to check specific capabilities. A logged-in Subscriber triggers wp_ajax_ hooks. If the function doesn't check current_user_can('manage_options'), the Subscriber can change site settings.11
Agent Logic:
Identify all add_action calls hooking into wp_ajax_*.
Trace the callback function.
Assert that the first logical block of the function contains a current_user_can() check.
Map the capability checked (e.g., edit_posts vs manage_options) to the sensitivity of the action performed in the function (e.g., update_option requires manage_options).13
3.3 The Nonce System (CSRF Protection)
WordPress uses "Nonces" (Numbers Used Once) to protect against Cross-Site Request Forgery (CSRF). Unlike cryptographic nonces, WordPress nonces are valid for a specific action and user within a 12-24 hour window (tick system).14
Mechanism: Nonces ensure that the user intends to perform an action. Without them, an attacker can trick an admin into clicking a link that updates a plugin setting or deletes a post.15
Agent Logic:
Creation: Look for wp_create_nonce() or wp_nonce_field() in form rendering code.
Verification: Look for wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() in form processing code ($_POST handling).
Vulnerability: If a function processes $_POST data to write to the database but lacks a nonce verification step, flag as Missing CSRF Protection (High Severity).16
Advanced Logic: Ensure the nonce check uses a unique action string (e.g., delete-post_123) rather than a generic one, preventing replay attacks across different contexts.17
3.4 REST API Authorization: permission_callback
The WordPress REST API introduces a standardized way to create endpoints. A critical security feature of register_rest_route is the permission_callback argument.
The Flaw: Developers sometimes set permission_callback => '__return_true' during development and forget to change it, or they omit the argument entirely (which defaults to open in older WP versions, though now generates a warning). This exposes the endpoint to the public internet.18
Privilege Escalation Vector: Publicly accessible endpoints that modify user data or site configuration allow for unauthenticated privilege escalation.19
Agent Logic:
Scan for register_rest_route.
Inspect the arguments array for permission_callback.
Flag Critical if permission_callback is missing or set to __return_true for any route using POST, PUT, PATCH, or DELETE methods.
Verify that the callback function performs a current_user_can check.
3.5 Insecure Direct Object References (IDOR)
IDOR occurs when an application provides direct access to objects based on user-supplied input without verifying ownership. In WordPress, this often involves Post IDs or User IDs.
Scenario: A plugin allows users to edit their profile via admin-ajax.php?action=edit_profile&user_id=15. If the code blindly trusts $_GET['user_id'] to update meta data, User 15 can change user_id to 1 (Admin) and take over the account.21
Agent Logic:
Identify variables representing IDs ($post_id, $user_id, $order_id) sourced from input.
Check if these IDs are used in sensitive functions (update_user_meta, wp_update_post).
Constraint: Ensure there is a check comparing the input ID against the currently logged-in user (get_current_user_id()) or a capability check that allows editing others (edit_others_posts).
4. Input Lifecycle: Validation, Sanitization, and Escaping
The mantra of WordPress security is "Validate Early, Sanitize Early, Escape Late".22 The scanning agent must enforce this lifecycle rigorously.
4.1 Data Validation
Validation is the boolean check of input data against an expected format. It answers the question: "Is this data what it claims to be?"
Agent Scanning Targets:
is_email(): For email fields.
is_numeric() / is_int(): For IDs and quantities.
validate_file(): Note that this function checks for directory traversal characters, not file existence. It returns 0 if the path is valid (safe), which is often confusing for developers who expect a boolean true/false.22 The agent should check for correct usage (e.g., if ( validate_file( $path )!== 0 ) { error }).
4.2 Data Sanitization
Sanitization cleans input data to make it safe for storage and processing. This must happen before data enters the database.
Agent Scanning Targets: The agent should map specific input types to their required sanitization functions:
Text/Strings: sanitize_text_field() (Removes tags, checks encoding).22
Rich Text: wp_kses_post() or wp_kses() (Allows specific HTML tags).
Keys/Slugs: sanitize_key() (Lowercase alphanumeric, underscores).24
Titles: sanitize_title().
SQL Order By: sanitize_sql_orderby() (Crucial for preventing injection in ORDER BY clauses).25
Files: sanitize_file_name() (Removes special chars from filenames).26
4.3 Context-Aware Escaping (Late Escaping)
Escaping renders data safe for output to the browser. The agent must verify that escaping occurs at the point of output (echo/print) and uses the correct function for the specific context (HTML, Attribute, JS, URL).22
Context
Vulnerability
Required Function
Agent Check
HTML Body
XSS
esc_html(), esc_html__()
Check echo statements inside <div> or <p>.
HTML Attribute
XSS (Attribute Breakout)
esc_attr(), esc_attr__()
Check echo inside value="..." or class="...".
URL
XSS (javascript: protocol)
esc_url()
Check echo inside href="..." or src="...".
JavaScript
XSS (Code Injection)
esc_js(), wp_json_encode()
Check output inside <script> blocks.
Translation
XSS
esc_html_e(), esc_attr_e()
Check usage of _e() vs esc_html_e().

5. Database Layer Security: SQL Injection and Advanced Vectors
SQL Injection (SQLi) allows attackers to manipulate database queries, leading to unauthorized data access or modification. WordPress provides the $wpdb class to handle database interactions safely, but improper usage is widespread.27
5.1 The $wpdb->prepare() Mechanism
The primary defense against SQLi in WordPress is $wpdb->prepare(). This function acts like sprintf(), substituting placeholders (%s, %d, %f) with sanitized values.
Secure Pattern: $wpdb->query( $wpdb->prepare( "SELECT * FROM table WHERE id = %d", $id ) );
Vulnerable Pattern: $wpdb->query( "SELECT * FROM table WHERE id = $id" );
Agent Logic:
Flag any use of $wpdb->query, get_results, get_var, get_row, etc., where the SQL string is constructed via concatenation (.) or variable interpolation ("SELECT... $var").29
Verify that prepare() is called before execution.
Deep Check: Ensure prepare is used correctly. Passing a variable directly as the query string ($wpdb->prepare($query)) without placeholders is still vulnerable if $query contains user input.30
5.2 Advanced SQLi Vectors
The agent must look beyond simple SELECT statements.
ORDER BY Injection: The %s placeholder in prepare() wraps values in quotes ('value'), which breaks ORDER BY clauses (e.g., ORDER BY 'date'). Developers often bypass prepare() here, leading to injection.
Remediation: Use a whitelist of allowed columns or sanitize_sql_orderby().25
Agent Logic: Scan for SQL strings containing ORDER BY and check if the column name is a variable. If so, trace it to ensure it passes through a whitelist check.
LIKE Wildcard Injection: Standard escaping does not escape % and _. An attacker can use these wildcards to perform Denial of Service (DoS) attacks by crafting expensive queries.
Remediation: Use $wpdb->esc_like() on the input before passing it to prepare().31
Agent Logic: Scan for LIKE clauses and verify the input variable is processed by esc_like().
IN Clause Injection: prepare() handles simple values but not arrays for IN clauses (e.g., WHERE id IN (1, 2, 3)).
Remediation: Use implode( ',', array_map( 'intval', $ids ) ) to sanitize the list manually.
Agent Logic: Detect IN clauses using variables. Verify that the variable is constructed safely using intval mapping or esc_sql on individual elements.32
5.3 Charset and SQL Modes
Charset Issues: In rare cases, specific charsets can allow SQLi via multi-byte characters. WordPress generally handles this via DB_CHARSET, but the agent should check if the plugin manually changes the charset connection.
SQL Modes: Plugins changing SQL modes (e.g., disabling STRICT_TRANS_TABLES) can weaken database integrity checks.
6. PHP-Specific Vulnerabilities: Serialization, Type Juggling, and Logic
Beyond standard web vulnerabilities, PHP's idiosyncrasies introduce unique attack vectors that the agent must detect.
6.1 PHP Object Injection (POI)
This is a critical vulnerability arising from the use of unserialize() on untrusted data.
Mechanism: If an attacker can control the string passed to unserialize(), they can instantiate arbitrary PHP objects. If the application (or any active plugin) contains a class with a "magic method" (like __destruct, __wakeup, __toString) that performs dangerous actions, this creates a "Property Oriented Programming" (POP) chain leading to RCE.33
Agent Logic:
Sink: unserialize().
Source: Any user input ($_POST, $_COOKIE, or database values that might be user-controlled).
Rule: Flag any usage of unserialize() on data that isn't hardcoded.
Remediation: Suggest using json_encode()/json_decode() instead. If serialization is mandatory, use maybe_unserialize() (WordPress wrapper) or PHP 7.0+ unserialize($data, ['allowed_classes' => false]).35
6.2 Phar Deserialization
A sophisticated attack vector where file system operations trigger deserialization.
Mechanism: The phar:// stream wrapper in PHP allows accessing files inside a PHP Archive (Phar). Accessing a file via file_exists('phar://path/to/file.phar') automatically deserializes the metadata contained in the Phar file manifest. This bypasses the need for an explicit unserialize() call.36
Agent Logic:
Identify file system sinks: file_exists, fopen, file_get_contents, is_dir, stat, unlink.
Check if the path argument is user-controlled.
Risk: If an attacker can upload a file (even with a .jpg extension) and then trick the application into passing its path (prepended with phar://) to a file function, they achieve RCE.
Mitigation: Ensure PHP 8.0+ (where this is disabled by default) or strictly validate paths to prevent the use of stream wrappers.38
6.3 PHP Type Juggling
PHP's loose comparison operator (==) performs type coercion, leading to logic bypasses.
Mechanism: if ($password == $hash) where $password is the integer 0 and $hash is a string starting with non-numeric characters will evaluate to true.40
Magic Hashes: Strings starting with 0e followed by digits are treated as scientific notation (0 to the power of X), resulting in 0. 0e1234 == 0e5678 evaluates to true.
Agent Logic:
Scan for == or != comparisons involving sensitive data (hashes, tokens, passwords).
Suggest replacing with strict comparison === or !==, or using hash_equals() for timing-attack safe string comparison.
7. File System Integrity: Uploads, Inclusion, and Traversal
File system operations are high-stakes. A single flaw here often leads to immediate server compromise.
7.1 Unrestricted File Uploads
Allowing users to upload files is the most direct path to RCE if not handled perfectly.
Vulnerability: Attackers upload a PHP script (e.g., shell.php) disguised as an image.
Common Mistakes:
Checking $_FILES['file']['type'] (MIME type): This is user-supplied and easily spoofed.42
Blacklisting extensions: Attackers can use alternative extensions (.php5, .phtml) or double extensions (shell.php.jpg) if the server is misconfigured.44
Agent Logic:
Detect usage of move_uploaded_file().
Recommendation: The agent must enforce the use of wp_handle_upload(). This WordPress function performs robust checks on size, MIME type (server-side detection), and extensions.46
Advanced Check: Ensure mimes parameter in wp_handle_upload is restricted to safe types (e.g., images only).48
7.2 Local File Inclusion (LFI) and Directory Traversal
LFI allows attackers to read or execute files on the server.
Mechanism: include( plugin_dir_path(__FILE__). $_GET['page']. '.php' );. An attacker uses ../../wp-config to traverse directories and load sensitive files.49
Agent Logic:
Sinks: include, require, include_once, require_once.
Detection: Flag any inclusion where the path is concatenated with user input.
Validation Check: Look for validate_file() (returns 0 on success) or strict whitelisting (using in_array) before the inclusion.
Zip Extraction: Older WordPress versions had traversal issues in unzip_file. Ensure the plugin uses modern WP filesystem APIs for archive handling.50
8. Client-Side Security: XSS, Gutenberg, and UI Attacks
With the evolution of WordPress into a block-based editor (Gutenberg) powered by React, client-side security has become more complex.
8.1 Cross-Site Scripting (XSS) Patterns
Reflected XSS: Immediate execution via URL parameters. Agent looks for echo $_GET['q'].
Stored XSS: Execution of malicious scripts saved in the database. Agent looks for echo $post->post_title without escaping.
DOM-based XSS: Vulnerabilities in client-side JavaScript. Agent scans .js files for innerHTML, document.write, or usage of location.hash without sanitization.
8.2 Gutenberg and React Security
React is generally secure by default, escaping data in JSX. However, the "escape hatch" dangerouslySetInnerHTML poses a massive risk.
Vulnerability: <div dangerouslySetInnerHTML={{__html: userContent}} /> renders raw HTML, allowing XSS.51
Agent Logic:
Scan all JavaScript/JSX files for dangerouslySetInnerHTML.
Verification: Ensure the data passed to it is sanitized using a library like DOMPurify or wp.sce.trustAsHtml (if available in the context).52
Attribute Injection: React attributes can also be vulnerable if javascript: URIs are allowed.
8.3 Open Redirects
Open redirects allow attackers to leverage the site's trust to redirect users to phishing pages.
Mechanism: wp_redirect( $_GET['url'] );.54
Agent Logic:
Scan for wp_redirect.
Check if the argument is user-controlled.
Remediation: Enforce the use of wp_safe_redirect(), which restricts redirects to the local domain and a whitelist of allowed hosts.55
9. Network and API Security: SSRF, REST, and Redirects
9.1 Server-Side Request Forgery (SSRF)
SSRF allows attackers to use the WordPress server as a proxy to attack internal networks or cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/).
Mechanism: Plugins often fetch remote URLs for features like RSS feeds or image downloading using wp_remote_get($_GET['url']).57
Agent Logic:
Sinks: wp_remote_get, wp_remote_post, wp_remote_request, curl_exec, file_get_contents (with URL).
Detection: Flag usage where the URL comes from input.
Remediation: Suggest wp_safe_remote_get(), which automatically blocks private IP ranges and loopback addresses.58
10. The Agent's Scanning Rulebook: Signatures and Heuristics
This section provides the specific "list" requested for the agent's logic engine. This is a condensed blueprint for implementation.
10.1 Vulnerability Signatures Table
ID
Vulnerability Type
Detection Pattern / Logic
Severity
VULN-SQL-01
SQL Injection (Raw Query)
Sink: $wpdb->query, get_results, get_var.

Logic: Argument contains variable concatenation or double-quote interpolation.
Critical
VULN-SQL-02
SQL Injection (Prepared)
Sink: $wpdb->prepare.

Logic: First argument is a variable (not a string literal).
High
VULN-SQL-03
SQL Injection (Order By)
Sink: Query string contains ORDER BY.

Logic: Column/Direction is dynamic variable AND NOT sanitized via sanitize_sql_orderby or whitelist.
High
VULN-XSS-01
Reflected XSS
Sink: echo, print, printf.

Source: $_GET, $_POST.

Logic: No escaping function (esc_*) in path.
High
VULN-XSS-02
Stored XSS
Sink: echo.

Source: Database output (get_option, etc.).

Logic: No escaping function.
High
VULN-CSRF-01
Missing Nonce
Context: wp_ajax_* or admin_post_* hook.

Logic: Function body lacks check_admin_referer or wp_verify_nonce.
High
VULN-AUTH-01
Privilege Escalation
Context: wp_ajax_* hook.

Logic: Function body lacks current_user_can.
Critical
VULN-AUTH-02
Insecure Admin Check
Logic: Sensitive action gated only by is_admin().
Critical
VULN-POI-01
Object Injection
Sink: unserialize.

Source: Untrusted input.
Critical
VULN-FILE-01
Unsafe Upload
Sink: move_uploaded_file.

Logic: wp_handle_upload not used.
Critical
VULN-SSRF-01
Unsafe Remote Request
Sink: wp_remote_get.

Source: Untrusted URL.

Remediation: Use wp_safe_remote_get.
Medium
VULN-REST-01
Open REST Endpoint
Context: register_rest_route.

Logic: permission_callback missing or __return_true.
High
VULN-REACT-01
Dangerous HTML
Context: JS/JSX files.

Pattern: dangerouslySetInnerHTML without sanitizer.
High

10.2 Workflow for the Agent
Preparation Phase:
Identify Plugin Slug and Version.
Download source code to a sandbox environment.
Run composer install to pull dependencies (if any) to check composer.lock for vulnerable libraries.60
Static Analysis Phase (SAST):
AST Parsing: Use a PHP parser (e.g., nikic/php-parser or PHPCS engine) to generate the AST.
Taint Tracking: Map all Sources to Sinks.
Context Verification: Check for sanitizers/validators in the data path.
Config Check: Scan wp-config.php patterns or php.ini dependencies (e.g., allow_url_fopen).
Heuristic Analysis Phase:
Check for "Code Smells": hardcoded credentials, debug functions (print_r, var_dump) left in production, commented-out security checks.
False Positive Reduction: Apply "Confidence Scores". If data passes through a custom function named my_plugin_sanitize_..., lower the confidence of the vulnerability flag but still report for manual review.62
11. Operational Workflow: CI/CD Integration and False Positive Management
Automated scanning is most effective when integrated into the development lifecycle.
11.1 CI/CD Pipeline Integration
The agent should be deployed as a step in the Continuous Integration (CI) pipeline (GitHub Actions, GitLab CI, Jenkins).63
Trigger: Run scanning on every Pull Request (PR) and Merge to main.
Gating: Configure the pipeline to fail the build if High or Critical vulnerabilities are found.
Automated Testing: Combine static analysis with dynamic testing tools like PHPUnit (for unit tests) and Playwright (for End-to-End testing) to verify that security patches do not break functionality.64
11.2 Managing False Positives
False positives fatigue developers. The agent must include mechanisms to manage them.
Baseline/Suppression: Allow developers to flag a finding as "False Positive" or "Won't Fix" via code comments (e.g., // phpcs:ignore WordPress.Security.EscapeOutput -- Logic verified manual escaping).
Contextual Intelligence: Use the AST to understand control structures. If a variable is checked via in_array($var, $whitelist), the agent should recognize this as valid validation and suppress XSS/SQLi warnings for that variable.3
Confidence Levels: The output report should categorize findings by confidence (Certain, Firm, Tentative). Focus blocking rules on "Certain" findings to prevent pipeline congestion.
11.3 Remediation Workflow
When the agent detects a flaw:
Report: detailed output including file, line number, vulnerability type, and a snippet of the code.
Educational Context: Link to the specific WordPress function documentation (e.g., wp_nonce_field docs) to teach the developer the correct pattern.
Suggested Fix: Where possible, generate a diff showing the insecure code vs. the secure implementation (e.g., replacing $_POST['id'] with absint($_POST['id'])).
12. Conclusion
Securing WordPress plugins requires a shift from reactive patching to proactive, architectural security. By building a custom agent that understands the nuances of the WordPress API—from the prepare() method's handling of SQL to the permission_callback in REST routes—developers can create a robust defense against the most prevalent web attacks.
This report outlines the structural and logical requirements for such an agent. By enforcing the principles of early validation, strict sanitization, and context-aware escaping, and by integrating this logic into automated pipelines, the WordPress ecosystem can be hardened significantly, one plugin at a time. The proposed agent is not just a scanner; it is an enforcer of the "WordPress Way," ensuring that the flexibility of the CMS does not come at the cost of its security.
Works cited
WordPress Vulnerabilities Database 2025: Complete Security Intelligence Guide, accessed December 15, 2025, https://wpsecurityninja.com/wordpress-vulnerabilities-database/
State of WordPress Security 2025 - Patchstack, accessed December 15, 2025, https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/
False Positives and Tuning :: CRS Documentation, accessed December 15, 2025, https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/
What is static analysis? - Blog - Secure Code Warrior, accessed December 15, 2025, https://www.securecodewarrior.com/article/what-is-static-analysis
Why use ast syntax tree modification instead of regex replacement? - Stack Overflow, accessed December 15, 2025, https://stackoverflow.com/questions/72017024/why-use-ast-syntax-tree-modification-instead-of-regex-replacement
What it takes to build a Static Analysis tool - DEV Community, accessed December 15, 2025, https://dev.to/antoinecoulon/what-it-takes-to-build-a-static-analysis-tool-4p40
Using OWASP Top 10 to improve WordPress security - Melapress, accessed December 15, 2025, https://melapress.com/owasp-wordpress-security-top-10/
What is OWASP? What is the OWASP Top 10? - Cloudflare, accessed December 15, 2025, https://www.cloudflare.com/learning/security/threats/owasp-top-10/
is_admin() – Function - WordPress Developer Resources, accessed December 15, 2025, https://developer.wordpress.org/reference/functions/is_admin/
2.3: How to Prevent Authentication Bypass Vulnerabilities - Wordfence, accessed December 15, 2025, https://www.wordfence.com/learn/how-to-prevent-authentication-bypass-attacks/
I found 300+ vulnerabilities in WordPress plugins, Ask Me Anything! - Reddit, accessed December 15, 2025, https://www.reddit.com/r/Wordpress/comments/1elie04/i_found_300_vulnerabilities_in_wordpress_plugins/
AI Engine WordPress Plugin CVE-2025-11749: Brief Summary of Sensitive Information Exposure and Privilege Escalation - ZeroPath Blog, accessed December 15, 2025, https://zeropath.com/blog/cve-2025-11749-ai-engine-wordpress-plugin
What is WordPress Privilege Escalation? - MalCare, accessed December 15, 2025, https://www.malcare.com/blog/wordpress-privilege-escalation/
What is Nonce Verification in WordPress? - GreenGeeks, accessed December 15, 2025, https://www.greengeeks.com/glossary/nonce-verification/
How to Secure Your WordPress Plugin AJAX Endpoints - Voxfor, accessed December 15, 2025, https://www.voxfor.com/how-to-secure-your-wordpress-plugin-ajax-endpoints/
WordPress Plugin Developers Need to Make Sure Their Nonce Checks Both Work if a Nonce Isn't Sent or if the Nonce is Wrong - Plugin Vulnerabilities, accessed December 15, 2025, https://www.pluginvulnerabilities.com/2024/01/24/wordpress-plugin-developers-need-to-make-sure-there-nonce-checks-both-work-if-a-nonce-isnt-sent-or-if-the-nonce-is-wrong/
An Introduction to WordPress Nonces with Examples - Elegant Themes, accessed December 15, 2025, https://www.elegantthemes.com/blog/tips-tricks/an-introduction-to-wordpress-nonces-with-examples
WordPress REST API – custom routes & endpoints, accessed December 15, 2025, https://learn.wordpress.org/tutorial/wordpress-rest-api-custom-routes-endpoints/
Backdoor Code Routes Malicious Actions Through WordPress REST API, accessed December 15, 2025, https://www.pluginvulnerabilities.com/2025/02/20/backdoor-code-routes-malicious-actions-through-wordpress-rest-api/
WordPress bSecure Plugin CVE-2025-6187: Privilege Escalation via REST API Authorization Flaw - ZeroPath Blog, accessed December 15, 2025, https://zeropath.com/blog/cve-2025-6187-bsecure-wordpress-privilege-escalation
Fix IDOR Vulnerability in WordPress: 7 Effective Ways - Pentest Testing Corp, accessed December 15, 2025, https://www.pentesttesting.com/fix-idor-vulnerability-in-wordpress/
Validating, sanitizing, and escaping - WordPress VIP Documentation, accessed December 15, 2025, https://docs.wpvip.com/security/validating-sanitizing-and-escaping/
Data Validation and Sanitization in WordPress - DEV Community, accessed December 15, 2025, https://dev.to/gp-webdev/data-validation-and-sanitization-in-wordpress-3on9
Sanitizing, Escaping and Validating Data in WordPress - SitePoint, accessed December 15, 2025, https://www.sitepoint.com/sanitizing-escaping-validating-data-in-wordpress/
Use wpdb->prepare for `order by` column name - WordPress Development Stack Exchange, accessed December 15, 2025, https://wordpress.stackexchange.com/questions/138976/use-wpdb-prepare-for-order-by-column-name
Security Functions - Engineering Handbook, accessed December 15, 2025, https://engineering.hmn.md/guides/wordpress/security-functions/
How to Prevent SQL Injection in WordPress - Skynats, accessed December 15, 2025, https://www.skynats.com/blog/how-to-prevent-sql-injection-in-wordpress/
SQL Injection: A Detailed Guide for WordPress Users - Kinsta®, accessed December 15, 2025, https://kinsta.com/blog/sql-injection/
How To Find SQL Injection Vulnerabilities in WordPress Plugins and Themes - Wordfence, accessed December 15, 2025, https://www.wordfence.com/blog/2025/08/how-to-find-sql-injection-vulnerabilities-in-wordpress-plugins-and-themes/
wpdb – Class - WordPress Developer Resources, accessed December 15, 2025, https://developer.wordpress.org/reference/classes/wpdb/
The Vital Role of $wpdb->prepare() in WordPress - Koddr.io Blog, accessed December 15, 2025, https://blog.koddr.io/importance-wpdb-prepare-wordpress/
How to Prevent SQL Injection Attacks in WordPress (7 Steps) - Comodo SSL Certificate, accessed December 15, 2025, https://comodosslstore.com/blog/how-to-prevent-sql-injection-attacks-in-wordpress-7-steps.html
PHP unserialize() Deserialization Vulnerability | Security Vulnerability Database - Sourcery, accessed December 15, 2025, https://sourcery.ai/vulnerabilities/php-lang-security-unserialize-use
Learn about PHP Object Injection - Patchstack, accessed December 15, 2025, https://patchstack.com/academy/wordpress/vulnerabilities/php-object-injection/
600,000 WordPress Sites Affected by PHP Object Injection Vulnerability in Fluent Forms WordPress Plugin - Wordfence, accessed December 15, 2025, https://www.wordfence.com/blog/2025/09/600000-wordpress-sites-affected-by-php-object-injection-vulnerability-in-fluent-forms-wordpress-plugin/
WordPress Plugin String locator PHAR Deserialization (2.5.0) - Vulnerabilities - Acunetix, accessed December 15, 2025, https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-string-locator-phar-deserialization-2-5-0/
New PHP Code Execution Attack Puts WordPress Sites at Risk - The Hacker News, accessed December 15, 2025, https://thehackernews.com/2018/08/php-deserialization-wordpress.html
PHP Phar Remote Code Execution Vulnerability - NHS England Digital, accessed December 15, 2025, https://digital.nhs.uk/cyber-alerts/2018/cc-2623
Uncovering a PHAR Deserialization Vulnerability in WP Meta SEO and Escalating to RCE, accessed December 15, 2025, https://wpscan.com/blog/uncovering-a-phar-deserialization-vulnerability-in-wp-meta-seo-and-escalating-to-rce/
PHP Type Juggling Simplified - The SecOps Group, accessed December 15, 2025, https://secops.group/php-type-juggling-simplified/
PHP Type Juggling Vulnerabilities & How to Fix Them - Invicti, accessed December 15, 2025, https://www.invicti.com/blog/web-security/php-type-juggling-vulnerabilities
Ehxb | File Upload Vulnerabilities I - InfoSec Write-ups, accessed December 15, 2025, https://infosecwriteups.com/ehxb-file-upload-vulnerabilities-i-6ed033539682
File Upload Bypass: Upload Forms Threat Explained - Acunetix, accessed December 15, 2025, https://www.acunetix.com/websitesecurity/upload-forms-threat/
How to prevent every malicious file upload on my server? (check file type)? - Stack Overflow, accessed December 15, 2025, https://stackoverflow.com/questions/690108/how-to-prevent-every-malicious-file-upload-on-my-server-check-file-type
File upload security/attacks? : r/PHP - Reddit, accessed December 15, 2025, https://www.reddit.com/r/PHP/comments/lb2lq/file_upload_securityattacks/
wp_handle_upload WordPress function - WPTurbo, accessed December 15, 2025, https://wpturbo.dev/functions/wp_handle_upload/
How to Handle File Uploads in WordPress | Reintech media, accessed December 15, 2025, https://reintech.io/blog/handling-file-uploads-wordpress
Unrestricted File Upload in WordPress: 10 Proven Fixes, accessed December 15, 2025, https://www.pentesttesting.com/unrestricted-file-upload-in-wordpress/
What is Directory Traversal? - SolidWP, accessed December 15, 2025, https://solidwp.com/blog/what-is-directory-traversal/
WordPress Directory Traversal Attack - Beagle Security, accessed December 15, 2025, https://beaglesecurity.com/blog/vulnerability/wordpress-plugin-directory-traversal.html
Using dangerouslySetInnerHTML Safely in React and Next.js Production Systems, accessed December 15, 2025, https://dev.to/hijazi313/using-dangerouslysetinnerhtml-safely-in-react-and-nextjs-production-systems-115n
Security Best Practices for WordPress Block Development - rtCamp, accessed December 15, 2025, https://rtcamp.com/handbook/developing-for-block-editor-and-site-editor/security/
How to prevent XSS attacks when using dangerouslySetInnerHTML in React | by Jam3, accessed December 15, 2025, https://medium.com/@Jam3/how-to-prevent-xss-attacks-when-using-dangerouslysetinnerhtml-in-react-f669f778cebb
Learn about Open Redirect - Patchstack, accessed December 15, 2025, https://patchstack.com/academy/wordpress/vulnerabilities/open-redirect/
WordPress Open Redirect - Beagle Security, accessed December 15, 2025, https://beaglesecurity.com/blog/vulnerability/wordpress-open-redirect.html
Open Redirect Vulnerability: How It Works & How to Prevent It - StackHawk, accessed December 15, 2025, https://www.stackhawk.com/blog/what-is-open-redirect/
WordPress Server-Side Request Forgery (SSRF) Vulnerability 2024 - WP Hacked Help, accessed December 15, 2025, https://secure.wphackedhelp.com/blog/wordpress-ssrf-vulnerability/amp/
wp_safe_remote_get() – Function - WordPress Developer Resources, accessed December 15, 2025, https://developer.wordpress.org/reference/functions/wp_safe_remote_get/
Fix SSRF Vulnerability in WordPress: 7 Effective Ways - Pentest Testing Corp, accessed December 15, 2025, https://www.pentesttesting.com/ssrf-vulnerability-in-wordpress/
A06 Vulnerable and Outdated Components - OWASP Top 10:2021, accessed December 15, 2025, https://owasp.org/Top10/2021/A06_2021-Vulnerable_and_Outdated_Components/
False Positives and False Negatives with Container Images Scanners - Chainguard Academy, accessed December 15, 2025, https://edu.chainguard.dev/chainguard/chainguard-images/staying-secure/working-with-scanners/false-results/
How to Cut Through DAST False Positives and Prioritize Real Risks - Invicti, accessed December 15, 2025, https://www.invicti.com/blog/web-security/reduce-dast-false-positives
Create a Robust CI/CD Workflow for WordPress | Pantheon.io, accessed December 15, 2025, https://pantheon.io/learning-center/wordpress/ci-cd
ACF | WordPress Automated Testing for Developers, accessed December 15, 2025, https://www.advancedcustomfields.com/blog/wordpress-automated-testing/
Automated testing and Continuous Integration in WordPress development - Kinsta, accessed December 15, 2025, https://kinsta.com/blog/automated-testing/