Nonce verification in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a WordPress nonce verification fails?

Consider a WordPress plugin that uses check_admin_referer('my_action') to verify a nonce. What is the typical behavior if the nonce is invalid or missing?

A The function triggers a WordPress error and stops script execution immediately.

B The function returns false and the script continues without interruption.

C The function logs the error but allows the script to continue running.

D The function automatically regenerates a new nonce and retries verification.

💡 Hint

Think about how WordPress protects admin actions from unauthorized access.

The check_admin_referer() function verifies the nonce and if it fails, it triggers a WordPress error and stops the script execution to prevent unauthorized actions.

📝 Syntax

intermediate

Which code snippet correctly verifies a nonce in a WordPress AJAX handler?

You want to verify a nonce sent via POST in your AJAX handler function. Which snippet correctly checks the nonce named 'my_nonce'?

A if (check_admin_referer('my_nonce', 'my_action')) { wp_die('Invalid nonce'); }

B if (!check_ajax_referer('my_action', 'my_nonce', false)) { wp_die('Invalid nonce'); }

C if (!wp_verify_nonce($_POST['my_nonce'], 'my_action')) { wp_die('Invalid nonce'); }

D if (!wp_verify_nonce('my_action', $_POST['my_nonce'])) { wp_die('Invalid nonce'); }

💡 Hint

Remember the order of parameters for wp_verify_nonce and how to handle failure.

wp_verify_nonce() takes the nonce value first, then the action string. It returns false if invalid, so the condition negates it to trigger wp_die().

❓ state_output

advanced

What is the output of this nonce verification code snippet?

Given the following code in a WordPress plugin, what will be the output if the nonce is valid?

Wordpress

<?php
if (isset($_POST['my_nonce']) && wp_verify_nonce($_POST['my_nonce'], 'save_data')) {
  echo 'Nonce verified';
} else {
  echo 'Nonce failed';
}
?>

A Nonce failed

B Nonce verified

C PHP Warning: Undefined index 'my_nonce'

D No output

💡 Hint

Check the condition and what happens when the nonce is valid.

If the nonce is set and valid, the code echoes 'Nonce verified'. Otherwise, it echoes 'Nonce failed'.

🔧 Debug

advanced

Why does this nonce verification always fail?

Identify the reason why the nonce verification fails every time in this code snippet:

Wordpress

<?php
if (!wp_verify_nonce('save_data', $_POST['my_nonce'])) {
  wp_die('Invalid nonce');
}
?>

A The parameters to wp_verify_nonce are reversed; nonce value should be first.

B The nonce action string 'save_data' is missing from the POST data.

C wp_die() is called incorrectly without an error message.

D The nonce is not generated before verification.

💡 Hint

Check the order of parameters for wp_verify_nonce.

The first parameter to wp_verify_nonce() must be the nonce value, and the second is the action string. Reversing them causes verification to fail.

🧠 Conceptual

expert

Why is nonce verification important in WordPress forms?

Choose the best explanation for why WordPress uses nonce verification in forms and AJAX requests.

A To encrypt user data before sending it to the server for security.

B To speed up form submissions by caching nonce values.

C To validate user input formats like email and phone numbers.

D To prevent Cross-Site Request Forgery (CSRF) attacks by ensuring requests come from trusted sources.

💡 Hint

Think about what kind of attacks nonce verification protects against.

Nonces in WordPress protect against CSRF attacks by verifying that requests come from legitimate users and not attackers.