What is Plugin Security?

Plugin security is the process of ensuring your plugin code not only works but also does not introduce any security vulnerabilities. If your plugin has security vulnerabilities, it could make any WordPress site that has your plugin installed open to potential attacks and can lead to that site being compromised.

When developing, it’s important to develop a security mindset and think about how your code could be used maliciously:

• Don’t trust any data, whether it’s user input, third-party API data, or even data in your database. Always be checking to make sure it’s valid and safe to use.
• WordPress has a number of APIs that can help you with common tasks, such as sanitizing user input, validating data, and escaping output. Rely on using these APIs to help validate and sanitize your data instead of writing your own functions.
• Keep up to date with common vulnerabilities and keep your code up to date to prevent them.

Validating Data

Validating data is the process of testing it against a predefined pattern (or patterns) with a definitive result, either valid or invalid.

Untrusted data can come from many sources: users, third-party API data, even your database data can be considered untrusted, especially if another plugin has modified it. Even site admins can make a mistake and enter incorrect or insecure data, so it’s important to always be checking your data.

In this example, a deletion function requires that a numeric ID is posted to an admin-ajax callback:

add_action( 'wp_ajax_delete_form_submission', 'wp_learn_delete_form_submission' );
function wp_learn_delete_form_submission() {
    if ( ! isset( $_POST['id'] ) ) {
        wp_send_json_error( 'Invalid ID' );
    }
    $id = $_POST['id'];

    global $wpdb;
    $table_name = $wpdb->prefix . 'form_submissions';

    $sql    = "DELETE FROM $table_name WHERE id = $id";
    $result = $wpdb->get_results( $sql );

    return wp_send_json( array( 'result' => $result ) );
}

Here the ID is being used directly in the SQL query, without any validation. Again, this means that if a user were to submit an ID of 1; DROP TABLE form_submissions;, the same SQL DROP query would be run after the delete, and the table would be dropped.

To prevent this, you can use PHP’s type casting functionality to ensure that the value of $id is always an integer value. This can be done by adding (int) before the variable name, like so:

$id = (int) $_POST['id'];

Note that this will only work if the first character in the string passed via the $_POST array can be cast as an integer, otherwise the value of $id will be 0. In that case, it’s a good idea to update the code to handle this case:

if ($id === 0){
    // return early with an error
    return wp_send_json( array( 'result' => 'Invalid ID passed' ) );
}

Notice that the code follows a key principle of validating data, in that you do so as early as possible.

To read more about the various ways to validate data in your WordPress plugin, check out the section on Validating Data in the WordPress Developer Documentation.

Preventing Invalid Requests

Whenever a request is made to functionality that your plugin provides, it’s important to check that the request is valid. This means checking that the request is coming from a trusted source.

For example, in your plugin code you might have a shortcode that renders a form, where users can submit their information. The function to render the form might look like this:

add_shortcode( 'wp_learn_form_shortcode', 'wp_learn_form_shortcode' );
function wp_learn_form_shortcode() {
    ob_start();
    ?>
    <form method="post">
        <input type="hidden" name="wp_learn_form" value="submit">
        <div>
            <label for="email">Name</label>
            <input type="text" id="name" name="name" placeholder="Name">
        </div>
        <div>
            <label for="email">Email address</label>
            <input type="text" id="email" name="email" placeholder="Email address">
        </div>
        <div>
            <input type="submit" id="submit" name="submit" value="Submit">
        </div>
    </form>
    <?php
    $form = ob_get_clean();
    return $form;
}
?>

When the user submits the form, the data is sent to the server. The data is then processed by the plugin, sanitized, and stored in the database:

add_action( 'wp', 'wp_learn_maybe_process_form' );
function wp_learn_maybe_process_form() {
    if (!isset($_POST['wp_learn_form'])){
        return;
    }

    $name = sanitize_text_field( $_POST['name'] );
    $email = sanitize_email( $_POST['email'] );

    global $wpdb;
    $table_name = $wpdb->prefix . 'form_submissions';

    $sql = "INSERT INTO $table_name (name, email) VALUES ('$name', '$email')";
    $result = $wpdb->query($sql);
    if ( 0 < $result ) {
        wp_redirect( WPLEARN_SUCCESS_PAGE_SLUG );
        die();
    }

    wp_redirect( WPLEARN_ERROR_PAGE_SLUG );
    die();
}

Because the form might appear on any page where the shortcode is used, it’s possible that a malicious user could attempt to send a POST request to the form, either looking for a vulnerability in the plugin, or by sending multiple requests to the form.

To prevent this, you can check that the request is coming from a trusted source. To do this, you can implement something called a nonce, or a number used once.

First, in the form itself, you can add a nonce field by using the wp_nonce_field function, and passing a nonce action and nonce name to the function:

wp_nonce_field( 'wp_learn_form_nonce_action', 'wp_learn_form_nonce_field' );

When the form is rendered on the front end, a hidden field is added to the form, using the nonce name as the id and name attribute of the hidden field, and the generated nonce as the field value. This data is posted when the form is submitted.

Then, in the function that processes the form data, you can verify that the nonce is valid by using the wp_verify_nonce function, and by passing the POSTed nonce field and the nonce action to this function. If the result of this verification is false, you can exit early, preventing any further code execution:

if ( wp_verify_nonce( $_POST['wp_learn_form_nonce_field'], 'wp_learn_form_nonce_action' ) {
    wp_redirect( WPLEARN_ERROR_PAGE_SLUG );
    die();
}

Any time your plugin code makes a web request, be it via redirection to a new URL, POSTing data to a form, or making an AJAX request, you should check that the request is valid.

To read more about how to use nonces in your plugins, check out the section on Nonces in the WordPress Developer Documentation.