wordpress-security-validation
Teaches secure WordPress development practices to prevent XSS, CSRF, and SQL injection vulnerabilities through effective input handling.
Install this skill
Security score
The wordpress-security-validation skill was audited on Mar 1, 2026 and we found 19 security issues across 4 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Eval function call - arbitrary code execution
| 1452 | - [ ] No `eval()`, `assert()`, or `create_function()` |
Access to /etc/passwd
| 295 | | `sanitize_file_name()` | File uploads | `"../../etc/passwd"` | `"..etcpasswd"` | |
Access to /etc/passwd
| 395 | // Input: "../../etc/passwd", "my file!.php" |
Access to /etc/passwd
| 1279 | // Attacker visits: ?template=../../../../etc/passwd |
Path traversal to sensitive directory
| 295 | | `sanitize_file_name()` | File uploads | `"../../etc/passwd"` | `"..etcpasswd"` | |
Path traversal to sensitive directory
| 395 | // Input: "../../etc/passwd", "my file!.php" |
Path traversal to sensitive directory
| 1279 | // Attacker visits: ?template=../../../../etc/passwd |
Prompting for API key/token input
| 467 | $sanitized['api_key'] = preg_replace('/[^a-zA-Z0-9]/', '', $input['api_key']); |
External URL reference
| 80 | <img src="https://yoursite.com/wp-admin/admin.php?action=delete_user&id=1"> |
External URL reference
| 328 | // Input: "http://example.com" |
External URL reference
| 329 | // Output: "http://example.com" |
External URL reference
| 757 | $safe_url = "https://example.com"; |
External URL reference
| 759 | // Output: <a href="https://example.com">Link</a> |
External URL reference
| 1221 | <img src="https://yoursite.com/wp-admin/admin.php?action=delete_all_posts"> |
External URL reference
| 1259 | // Executes: https://yoursite.com/uploads/malicious.php |
External URL reference
| 1472 | <form action="https://yoursite.com/wp-admin/admin-post.php" method="POST"> |
External URL reference
| 1504 | wpscan --url https://yoursite.com --enumerate vp |
External URL reference
| 1532 | - [OWASP Top 10](https://owasp.org/www-project-top-ten/) |
External URL reference
| 1533 | - [WordPress Plugin Security Testing](https://make.wordpress.org/plugins/handbook/security/) |
Install this skill with one command
/learn @macphobos/toolchains-php-frameworks-wordpress-security-validation