Plugin security (nonces, sanitization) in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of a nonce in WordPress plugin security?

In WordPress plugin development, nonces are often used. What is their main purpose?

A To verify that a request comes from a legitimate source and prevent CSRF attacks

B To encrypt user data before saving it to the database

C To speed up plugin execution by caching results

D To validate user input formats like email or phone numbers

💡 Hint

Think about how plugins protect actions triggered by users from outside attackers.

Nonces in WordPress are security tokens that help verify requests are intentional and from trusted users, preventing Cross-Site Request Forgery (CSRF) attacks.

❓ component_behavior

intermediate

What happens if you omit nonce verification in a WordPress plugin form submission?

Consider a WordPress plugin form that processes user input but does not verify the nonce. What is the likely outcome?

A The form will not submit because WordPress blocks it automatically

B The plugin will throw a fatal PHP error on submission

C The form submission is vulnerable to CSRF attacks allowing unauthorized actions

D The plugin will sanitize inputs automatically without nonce

💡 Hint

Think about what nonce verification protects against and what happens if it is missing.

Without nonce verification, attackers can trick logged-in users into submitting forms unknowingly, leading to unauthorized actions.

📝 Syntax

advanced

Which code snippet correctly verifies a nonce in a WordPress plugin?

Choose the code snippet that properly checks a nonce named 'my_nonce' sent via POST before processing the form.

Wordpress

<?php
if (/* your code here */) {
    wp_die('Security check failed');
} else {
    // process form
}
?>

A if ( ! isset($_POST['my_nonce']) || ! wp_verify_nonce($_POST['my_nonce'], 'my_action') )

B if ( wp_verify_nonce($_POST['my_nonce'], 'my_action') )

C if ( isset($_POST['my_nonce']) && wp_verify_nonce($_POST['my_nonce'], 'my_action') )

D if ( ! wp_verify_nonce('my_nonce', $_POST['my_action']) )

💡 Hint

Remember to check if the nonce exists and that verification returns true.

Option A correctly checks if the nonce is set and verifies it returns true. The condition negates this to stop processing if verification fails.

🔧 Debug

advanced

Why does this plugin code fail to sanitize user input properly?

Review this code snippet from a WordPress plugin:

<?php
$user_input = $_POST['user_data'];
$clean_input = sanitize_text_field($user_input);
update_option('my_option', $user_input);
?>

Why is the sanitization ineffective?

A Because sanitize_text_field() does not sanitize POST data

B Because the unsanitized $user_input is saved instead of $clean_input

C Because update_option() automatically sanitizes data

D Because $user_input is sanitized twice causing errors

💡 Hint

Check which variable is saved to the database.

The code sanitizes $user_input into $clean_input but saves the original unsanitized $user_input, making sanitization ineffective.

❓ state_output

expert

What is the output of this WordPress plugin code snippet regarding nonce verification and sanitization?

Given the following code snippet, what will be the output if the nonce is invalid and the user input is <script>alert('x')</script>?

Wordpress

<?php
if ( ! isset($_POST['my_nonce']) || ! wp_verify_nonce($_POST['my_nonce'], 'my_action') ) {
    echo 'Nonce verification failed';
    exit;
}
$input = sanitize_text_field($_POST['user_input']);
echo 'User input: ' . $input;
?>

A Fatal error: Undefined index: my_nonce

B User input: alert('x')

C User input: &lt;script&gt;alert('x')&lt;/script&gt;

D Nonce verification failed

💡 Hint

Consider what happens when nonce verification fails.

If the nonce is missing or invalid, the code echoes 'Nonce verification failed' and stops execution before sanitizing or echoing user input.