Plugin security (nonces, sanitization) in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of a nonce in WordPress plugin security?

In WordPress plugin development, nonces are often used. What is their main purpose?

A To verify that a request comes from a legitimate source and prevent CSRF attacks

B To encrypt user data before saving it to the database

C To speed up plugin execution by caching results

D To validate user input formats like email or phone numbers

💡 Hint

Think about how plugins protect actions triggered by users from outside attackers.

Nonces in WordPress are security tokens that help verify requests are intentional and from trusted users, preventing Cross-Site Request Forgery (CSRF) attacks.

❓ component_behavior

intermediate

What happens if you omit nonce verification in a WordPress plugin form submission?

Consider a WordPress plugin form that processes user input but does not verify the nonce. What is the likely outcome?

A The form will not submit because WordPress blocks it automatically

B The plugin will throw a fatal PHP error on submission

C The form submission is vulnerable to CSRF attacks allowing unauthorized actions

D The plugin will sanitize inputs automatically without nonce

💡 Hint

Think about what nonce verification protects against and what happens if it is missing.

Without nonce verification, attackers can trick logged-in users into submitting forms unknowingly, leading to unauthorized actions.

📝 Syntax

advanced

Which code snippet correctly verifies a nonce in a WordPress plugin?

Choose the code snippet that properly checks a nonce named 'my_nonce' sent via POST before processing the form.

Wordpress

<?php
if (/* your code here */) {
    wp_die('Security check failed');
} else {
    // process form
}
?>

A if ( ! isset($_POST['my_nonce']) || ! wp_verify_nonce($_POST['my_nonce'], 'my_action') )

B if ( wp_verify_nonce($_POST['my_nonce'], 'my_action') )

C if ( isset($_POST['my_nonce']) && wp_verify_nonce($_POST['my_nonce'], 'my_action') )

D if ( ! wp_verify_nonce('my_nonce', $_POST['my_action']) )

💡 Hint

Remember to check if the nonce exists and that verification returns true.

Option A correctly checks if the nonce is set and verifies it returns true. The condition negates this to stop processing if verification fails.

🔧 Debug

advanced

Why does this plugin code fail to sanitize user input properly?

Review this code snippet from a WordPress plugin:

<?php
$user_input = $_POST['user_data'];
$clean_input = sanitize_text_field($user_input);
update_option('my_option', $user_input);
?>

Why is the sanitization ineffective?

A Because sanitize_text_field() does not sanitize POST data

B Because the unsanitized $user_input is saved instead of $clean_input

C Because update_option() automatically sanitizes data

D Because $user_input is sanitized twice causing errors

💡 Hint

Check which variable is saved to the database.

The code sanitizes $user_input into $clean_input but saves the original unsanitized $user_input, making sanitization ineffective.

❓ state_output

expert

What is the output of this WordPress plugin code snippet regarding nonce verification and sanitization?

Given the following code snippet, what will be the output if the nonce is invalid and the user input is <script>alert('x')</script>?

Wordpress

<?php
if ( ! isset($_POST['my_nonce']) || ! wp_verify_nonce($_POST['my_nonce'], 'my_action') ) {
    echo 'Nonce verification failed';
    exit;
}
$input = sanitize_text_field($_POST['user_input']);
echo 'User input: ' . $input;
?>

A Fatal error: Undefined index: my_nonce

B User input: alert('x')

C User input: &lt;script&gt;alert('x')&lt;/script&gt;

D Nonce verification failed

💡 Hint

Consider what happens when nonce verification fails.

If the nonce is missing or invalid, the code echoes 'Nonce verification failed' and stops execution before sanitizing or echoing user input.

Practice

1. What is the main purpose of using a nonce in a WordPress plugin?

easy

A. To speed up the plugin loading time

B. To protect against unauthorized or fake form submissions

C. To style the plugin interface

D. To store user preferences permanently

Solution

1. Step 1: Understand what a nonce is

   A nonce is a unique token used to verify that a request comes from a trusted source.

2. Step 2: Identify nonce purpose in plugins

   Nonces prevent attackers from submitting fake or unauthorized requests to your plugin.

3. Final Answer:

   To protect against unauthorized or fake form submissions -> Option B

4. Quick Check:

   Nonce = Security token for requests [OK]

Hint: Nonces stop fake requests, like a secret handshake [OK]

Common Mistakes:

• Thinking nonce speeds up plugin
• Using nonce for styling
• Confusing nonce with data storage

2. Which of the following is the correct way to check a nonce in a WordPress plugin?

easy

A. check_nonce('my_nonce')

B. nonce_check('my_nonce')

C. wp_verify_nonce($_POST['my_nonce'], 'my_action')

D. verify_nonce('my_nonce')

Solution

1. Step 1: Recall the WordPress function for nonce verification

   The correct function to verify a nonce is wp_verify_nonce().

2. Step 2: Check the correct usage

   The function takes the nonce value and the action name as parameters, like wp_verify_nonce($_POST['my_nonce'], 'my_action').

3. Final Answer:

   wp_verify_nonce($_POST['my_nonce'], 'my_action') -> Option C

4. Quick Check:

   Verify nonce = wp_verify_nonce() [OK]

Hint: Use wp_verify_nonce() with nonce and action [OK]

Common Mistakes:

• Using non-existent functions like check_nonce
• Passing wrong parameters order
• Not using $_POST or $_GET to get nonce

3. What will be the output of this code snippet in a WordPress plugin?

if ( ! wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  echo 'Invalid nonce';
} else {
  $name = sanitize_text_field($_POST['name']);
  echo 'Hello, ' . $name;
}

Assuming the nonce is valid and $_POST['name'] = '<script>alert(1)</script>John'?

medium

A. Hello, John

B. Hello, John

C. Invalid nonce

D. Hello, alert(1)John

Solution

1. Step 1: Check nonce validity

   The nonce is valid, so the else block runs.

2. Step 2: Understand sanitize_text_field effect

   This function removes HTML tags like <script>, so the input becomes 'alert(1)John' because sanitize_text_field removes tags but leaves the text inside.

3. Step 3: Clarify output

   The output will be 'Hello, alert(1)John' because the script tags are stripped but the text 'alert(1)' remains.

4. Final Answer:

   Hello, alert(1)John -> Option D

5. Quick Check:

   Sanitize removes tags but keeps text inside [OK]

Hint: sanitize_text_field strips HTML tags but keeps inner text [OK]

Common Mistakes:

• Assuming sanitize_text_field allows HTML
• Ignoring nonce check result
• Confusing output with raw input

4. Identify the error in this WordPress plugin code snippet:

if ( ! wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  wp_die('Security check failed');
}
$name = sanitize_text_field($_POST['name']);
update_option('user_name', $name);

medium

A. Not checking if $_POST['name'] is set before sanitizing

B. Missing nonce field in the form

C. Using update_option instead of add_option

D. No error, code is correct

Solution

1. Step 1: Check nonce verification

   The nonce is verified correctly with wp_verify_nonce and wp_die on failure.

2. Step 2: Check input sanitization safety

   The code sanitizes $_POST['name'] without checking if it exists, which can cause a PHP notice or error.

3. Final Answer:

   Not checking if $_POST['name'] is set before sanitizing -> Option A

4. Quick Check:

   Always check input exists before sanitizing [OK]

Hint: Check if input exists before sanitize_text_field [OK]

Common Mistakes:

• Assuming update_option is wrong here
• Ignoring missing input checks
• Thinking nonce check is missing

5. You want to securely save a user email from a form in your WordPress plugin. Which combination of code snippets correctly uses nonce verification and sanitization?

// 1. Verify nonce
if ( ! wp_verify_nonce($_POST['nonce'], 'save_email') ) {
  wp_die('Invalid request');
}

// 2. Sanitize input
$email = ???

// 3. Save email
update_option('user_email', $email);

Choose the correct code for step 2:

hard

A. $email = sanitize_email($_POST['email']);

B. $email = sanitize_text_field($_POST['email']);

C. $email = esc_html($_POST['email']);

D. $email = wp_strip_all_tags($_POST['email']);

Solution

1. Step 1: Confirm nonce verification

   The nonce is verified correctly before processing input.

2. Step 2: Choose proper sanitization for email

   For emails, sanitize_email() is the correct function to clean and validate email format.

3. Step 3: Understand other options

   sanitize_text_field() is for plain text, esc_html() is for output escaping, and wp_strip_all_tags() removes tags but does not validate email.

4. Final Answer:

   $email = sanitize_email($_POST['email']); -> Option A

5. Quick Check:

   Email input = sanitize_email() [OK]

Hint: Use sanitize_email() for email inputs [OK]

Common Mistakes:

• Using sanitize_text_field for emails
• Confusing escaping with sanitizing
• Not verifying nonce before saving