wp-ajax-nopriv-visibility

What problem does it solve?

This Skill identifies and mitigates the risk of unauthenticated exposure caused by wp_ajax_nopriv_ handlers that build WP_Query arguments from client input, potentially leaking private, draft, or trashed content to anonymous users.

Core Features & Use Cases

• Auditing and pattern discovery: scans for wp_ajax_nopriv_ handlers, client-parsed query strings, and indicators of widened visibility.
• Defensive fixes and guidance: provides a field-tested patch pattern to strip dangerous keys (e.g., post_status, perm, suppress_filters) and to safely default post_status to publish, with careful treatment of post_type.
• Regression and validation guidance: includes checks to ensure narrowing keys are preserved, and whitelists are server-trusted when widening is truly necessary.

Quick Start

Audit the site's wp_ajax_nopriv handlers and apply the recommended hardening pattern to sanitize input and limit visibility.