skills.rest
WordPressBugBounty
WordPressBugBountyOFFICIAL
Explore all skills by this author →
GitHub

wp-security-check

Audit WordPress plugins for security weaknesses across nonce, authorization, sanitization, escaping, SQL injection, and REST permissions.

Updated Sep 22, 2024
Search Tags:#sql injection#security audit#rest api#wordpress#pci dss#nonce validation#woocommerce hpos
One-click install
npx skills add https://github.com/WordPressBugBounty/plugins-woocommerce-for-japan --skill wp-security-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wp-security-check
Source: https://github.com/WordPressBugBounty/plugins-woocommerce-for-japan/tree/main/woocommerce-for-japan/.claude/skills/wp-security-check
Command: npx skills add https://github.com/WordPressBugBounty/plugins-woocommerce-for-japan --skill wp-security-check

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you identify common WordPress plugin security flaws—such as missing nonce/capability checks, improper sanitization/escaping, unsafe SQL usage, insecure REST endpoints, and payment-specific PCI DSS violations—before they become vulnerabilities.

Core Features & Use Cases

  • Input sanitization review: Locates $_POST, $_GET, $_REQUEST, and $_COOKIE usage and checks for appropriate sanitizers (including WooCommerce-specific patterns like wc_clean).
  • Output escaping review: Finds potential XSS sinks by scanning echo/inline output patterns and verifying the correct escaping function for the output context.
  • CSRF/nonce validation checks: Ensures form submissions, AJAX handlers, and REST permissions use the expected nonce and authorization mechanisms.
  • Capability enforcement validation: Confirms current_user_can() guards all privileged operations and mutations.
  • SQL injection prevention: Verifies $wpdb queries use $wpdb->prepare() for any variable-containing queries.
  • REST API security validation: Ensures every registered REST route includes a permission_callback, especially for write operations.
  • WooCommerce-specific safety: Flags order-handling patterns that violate HPOS expectations (e.g., order meta access via get_post_meta()).
  • Payment / PCI DSS guardrails: Checks for risky card data handling patterns like logging or storing card details, and validates safe payment practices.

Quick Start

Run the security audit against your plugin by providing the plugin root path and selecting whether the audit scope includes payment processing so the Skill can apply PCI DSS and WooCommerce-specific checks.

Frequently Asked Questions about wp-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a WordPress plugin for security vulnerabilities?▼

To audit a WordPress plugin for security vulnerabilities, provide the plugin root path and the tool will scan for missing nonce checks, capability gaps, unsafe SQL, and XSS risks. You can run a full-plugin review or scope it to specific files.

How do I check if my WordPress REST API endpoints have permission control?▼

To check WordPress REST API endpoints for permission control, the audit validates that every route registered via `register_rest_route` includes a mandatory `permission_callback`, especially for write operations, to prevent unauthorized mutations.

Does this security audit support WooCommerce HPOS order data handling checks?▼

Yes, this security audit supports WooCommerce HPOS checks by flagging order-handling patterns that violate HPOS expectations, such as accessing order meta via `get_post_meta()` instead of the recommended HPOS data stores.

What is the best way to prevent SQL injection in WordPress database queries?▼

The best way to prevent SQL injection in WordPress database queries is to use `$wpdb->prepare()` for any variable-containing queries. The audit verifies that all `$wpdb` queries safely prepare variables to block injection attempts.

Can I scan my WordPress plugin for PCI DSS payment data violations?▼

Yes, you can scan WordPress plugins for PCI DSS payment data violations by enabling the payment processing scope. The audit checks for risky card data handling patterns like logging or storing card details and validates safe payment practices.

Why does my WordPress AJAX handler need nonce validation and capability checks?▼

Your WordPress AJAX handler needs nonce validation and capability checks to prevent CSRF attacks and unauthorized access. The audit ensures `check_ajax_referer` and `current_user_can()` guards are present on all privileged operations.

Related Skills

Explore More Legal & Compliance Skills→
zebbernzebbern
4.5k

IDOR Vulnerability Testing

Identify and exploit IDOR vulnerabilities in web applications.

Community
Advanced
artisanworkshopartisanworkshop
3

wp-security-check

Audit WordPress plugin PHP code for security failures and unsafe patterns.

Official
Advanced
MatthieuszMatthieusz

coding-standards

Validate TypeScript code against predefined coding standards using static analysis tools.

Community
Advanced
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced