php-wordpress-audit

PHP WordPress framework security audit (php-wordpress-audit)

Analyze the framework feature security mechanisms in a WordPress project, with key coverage of:

• nonce verification and capability permission checks (to prevent CSRF and privilege escalation)
• WordPress AJAX callbacks (admin-ajax.php of wp_ajax_* and wp_ajax_nopriv_*）
• Output escaping and template injection risks (esc_html/esc_attr/esc_url/wp_kses, etc.)
• $wpdb Query parameterization and direct concatenation risks
• Redirects (wp_redirect and wp_safe_redirect)
• Upload handling (wp_handle_upload) and executable file risks
• Remote HTTP (wp_remote_get/wp_remote_post) and SSRF associations

Input

User-provided:

• source_path: WordPress code directory root (containing wp-content/plugins or theme directories) Optional:
• output_path: output directory path (default {source_path}_audit）

Output Directory

Output to:

{output_path}/framework_audit/
  wordpress_{timestamp}.md

Framework identification (required)

Evidence points for identifying WordPress must be provided (unsubstantiated assertions are not allowed):

• Directory features:wp-content/、wp-admin/、wp-includes/
• Core files:wp-config.php or wp-settings.php
• Plugin/theme directories:wp-content/plugins/、wp-content/themes/

Risk type mapping (required)

Each finding must state:

• General type code:AUTH / CSRF / XSS / SQL / CFG / SSRF / UPLOAD , etc.
• Mapping reason: why the WordPress risk falls under that type code

Mandatory audit checklist (required: check each item and output results)

1) nonce and CSRF protection (CSRF/AUTH)

Must locate and output:

• Form output nonce:wp_nonce_field or custom nonce output
• Verification at submission point:check_admin_referer、wp_verify_nonce location
• AJAX nonce verification:check_ajax_referer(if present)

Decision rules:

• If a nonce exists but verification is missing or is only performed in some branches, output a CSRF or AUTH risk

2) capability permission checks (AUTH)

Must locate and output:

• Before all sensitive operations:current_user_can、user_can、is_user_logged_in
• Whether the capability value is user-controlled or too broad (for example, only manage_options is missing but high-privilege operations are still executed)

3) AJAX action and route exposure (AUTH/CSRF)

Must locate and output:

• add_action('wp_ajax_{action}', {value}) and add_action('wp_ajax_nopriv_{action}', {value})
• Whether the callback function internally verifies capability and nonce

4) Output escaping and XSS (XSS)

Must locate and output:

• Points where user data is directly echoed/printed
• Whether esc_html、esc_attr、esc_url、wp_kses_post , etc. are used
• Whether plugins/themes disable filtering or use raw output

5) $wpdb Query parameterization (SQL)

Must locate and output:

• Correct path:$wpdb->prepare and use of prepare placeholders
• Dangerous path:$wpdb->query、get_results、get_row Direct concatenation of SQL strings

6) Redirect and navigation safety (REDIR/CFG)

Must locate and output:

• wp_redirect and wp_safe_redirect Usage
• Destination source (usually user input) and whether scheme/host validation is performed

7) Upload and remote requests (UPLOAD/SSRF)

Must locate and output:

• Upload:wp_handle_upload、media_handle_upload, and whether file type/directory/access control is secure
• Remote request:wp_remote_get/wp_remote_post, whether the destination URL is controllable and whether an allowlist is applied

Observable PoC (required: framework-specific observable verification framework)

Provide at least one of the following two categories and clearly state the observation points:

• CSRF: an action missing nonce validation; craft a request with a missing or incorrect nonce, and observe the response and state change
• AUTH: an action missing capability validation; use a low-privilege user to request a sensitive action, and observe whether it succeeds

PoC output requirements:

• Must include the action identifier and the real request entry point (usually admin-ajax.php or the corresponding form submission path)
• Must explain the result you want to observe (HTTP status code and business-side effect)

Output completeness check (mandatory)

• Output includes: check results for nonce/capability/AJAX/XSS/SQL/REDIR/UPLOAD/SSRF
• Each risk has: mapped type code + location evidence + observable verification framework + remediation suggestion