wp-security-deep

What problem does it solve?

Deep security audit for WordPress plugin/theme PHP code, covering issues beyond the basic sanitize/escape/nonce checklist — including PHP object injection (unserialize), SSRF in remote requests, CSRF on state-changing GET handlers, mass assignment via $_POST loops, insecure file include / template injection, mail header injection, ZipSlip in archive extraction, type juggling in auth comparisons, and TOCTOU race patterns in option/meta locks. Use after or alongside wp-security-audit when reviewing complex plugins, REST APIs, integrations that fetch remote URLs, file processors, or any code that handles uploads, archives, or self-rolled auth tokens.

Core Features & Use Cases

• Detect advanced PHP security issues beyond basic checks in WordPress plugins and themes.
• Identify critical flaws such as object injection, SSRF, CSRF on GET handlers, mass assignment, insecure file inclusion, mail header injection, ZipSlip, and TOCTOU patterns.
• Provide actionable remediation guidance and integration with wp-security-audit for layered defense.

Quick Start

Run a deep PHP security review on a WordPress plugin or theme using the checks described.