wp-security-check

To audit WordPress plugin code for SQL injection and CSRF vulnerabilities, scan PHP files for missing nonce validation and unsafe $wpdb variable queries lacking $wpdb->prepare(). This identifies failures in nonce checks and unprotected database calls before production.

Yes, a WordPress security audit can check WooCommerce REST API permission callbacks and HPOS patterns by verifying permission_callback enforcement and scanning for correct order-meta usage within WooCommerce 9.0+ and WordPress 6.7+ contexts.

The best way to check plugin code for PCI DSS compliance is to scan payment processing logic for insecure card data logging or storage. This flags PCI DSS-relevant hygiene issues and payment logger vulnerabilities during static code review.

To verify capability checks and output escaping in custom WordPress admin pages, scan the code for current_user_can gates and required escaping functions. This detects missing privilege escalation protections and XSS prevention patterns.

Yes, you can scan specific plugin files for AJAX nonce validation by setting the audit scope to target individual files instead of the full plugin. This narrows the static review to check_ajax_referer patterns within defined routes.

A WordPress plugin fails REST API permission checks during a security review when route registration flows lack proper permission_callback enforcement. Static scanning identifies missing REST API permission controls that expose endpoints to unauthorized access.