WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting
prevent path disclosure error reporting
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 22 | 4,466 | 3,972 | 10k+ | Output is not escaped | ||
| #52 | HeadSpace2 SEO | 22 | 940 | 360 | 3k+ | Text Domain Mismatch | ||
| #53 | Hesabfa Accounting | 22 | 467 | 718 | 400 | Text Domain Mismatch | ||
| #54 | Heureka | 22 | 557 | 254 | 400 | Exception output is not escaped | ||
| #55 | InfiniteWP Client | 22 | 2,286 | 1,812 | 200k+ | Exception output is not escaped | ||
| #56 | JCH Optimize | 22 | 1,143 | 136 | 4k+ | Output is not escaped | ||
| #57 | Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress | 22 | 919 | 1,230 | 10k+ | Output is not escaped | ||
| #58 | Newsletters | 22 | 2,968 | 2,248 | 2k+ | Text Domain Mismatch | ||
| #59 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,266 | 2,059 | 100k+ | Non-prefixed global variable | ||
| #60 | Packeta | 22 | 801 | 333 | 8k+ | Exception output is not escaped | ||
| #61 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | SQL query is not prepared | ||
| #62 | Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 22 | 1,581 | 2,326 | 300k+ | Non-prefixed global variable | ||
| #63 | Product Catalog Feed by PixelYourSite | 22 | 581 | 357 | 8k+ | Output is not escaped | ||
| #64 | Salon Booking System – Free Version | 22 | 655 | 620 | 2k+ | Missing direct file access protection | ||
| #65 | Seraphinite Accelerator | 22 | 594 | 255 | 50k+ | Output is not escaped | ||
| #66 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | Text Domain Mismatch | ||
| #67 | NextScripts: Social Networks Auto-Poster | 22 | 2,408 | 1,133 | 30k+ | Output is not escaped | ||
| #68 | Unlimited Elements Blocks Library | 22 | 708 | 1,822 | 400 | Non-prefixed global variable | ||
| #69 | Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links | 22 | 1,044 | 1,797 | 20k+ | Non-prefixed global variable | ||
| #70 | CoDesigner – All in One Elementor WooCommerce Builder | 22 | 4,131 | 774 | 5k+ | Text Domain Mismatch | ||
| #71 | ManageWP Worker | 22 | 507 | 565 | 1m+ | Non-prefixed class | ||
| #72 | File Manager | 22 | 740 | 520 | 1m+ | Unsafe printing function | ||
| #73 | WP Umbrella: Update Backup Restore & Monitoring | 22 | 921 | 919 | 70k+ | Exception output is not escaped | ||
| #74 | WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript | 22 | 164 | 257 | 9k+ | Non-prefixed constant | ||
| #75 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | Exception output is not escaped | ||
| #76 | Business Directory Plugin – Easy Listing Directories for WordPress | 23 | 611 | 1,063 | 10k+ | Non-prefixed global variable | ||
| #77 | Classified Listing – AI-Powered Classified ads & Business Directory | 23 | 155 | 2,074 | 9k+ | Non-prefixed global variable | ||
| #78 | Anti-Malware Security and Brute-Force Firewall | 23 | 543 | 965 | 100k+ | Output is not escaped | ||
| #79 | Houzez Property Feed | 23 | 1,464 | 1,585 | 1k+ | Text Domain Mismatch | ||
| #80 | Hunk Companion | 23 | 2,547 | 687 | 6k+ | Text Domain Mismatch | ||
| #81 | IP Geo Block | 23 | 399 | 589 | 8k+ | Output is not escaped | ||
| #82 | Joli FAQ SEO – WordPress FAQ Plugin | 23 | 1,083 | 1,526 | 700 | Non-prefixed global variable | ||
| #83 | Justified Gallery | 23 | 589 | 1,417 | 8k+ | Non-prefixed global variable | ||
| #84 | Locatoraid Store Locator | 23 | 318 | 645 | 1k+ | Non-prefixed global variable | ||
| #85 | MailPoet – Newsletters, Email Marketing, and Automation | 23 | 931 | 718 | 500k+ | Exception output is not escaped | ||
| #86 | Media Library Assistant | 23 | 1,144 | 3,943 | 70k+ | Nonce verification recommended | ||
| #87 | Order Bump for WooCommerce | 23 | 1,720 | 1,562 | 600 | Output is not escaped | ||
| #88 | MyWorks Sync for WooCommerce & QuickBooks Online | 23 | 2,292 | 9,101 | 5k+ | Non-prefixed global variable | ||
| #89 | ND Shortcodes | 23 | 621 | 2,426 | 20k+ | Non-prefixed global variable | ||
| #90 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | Exception output is not escaped | ||
| #91 | Postie | 23 | 408 | 259 | 10k+ | Output is not escaped | ||
| #92 | PowerPress Podcasting plugin by Blubrry | 23 | 4,807 | 2,394 | 20k+ | Output is not escaped | ||
| #93 | Manago AI & Leadoo AI | 23 | 644 | 429 | 1k+ | Unsafe printing function | ||
| #94 | Seraphinite Post .DOCX Source | 23 | 1,156 | 110 | 900 | Output is not escaped | ||
| #95 | Seriously Simple Podcasting | 23 | 548 | 627 | 30k+ | Non-prefixed hook name | ||
| #96 | Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management | 23 | 295 | 298 | 4k+ | Non-prefixed global variable | ||
| #97 | ThemeHunk Customizer | 23 | 3,968 | 582 | 6k+ | Text Domain Mismatch | ||
| #98 | Trinity Audio – Text to Speech AI audio player to convert content into audio | 23 | 119 | 227 | 2k+ | Non-prefixed global variable | ||
| #99 | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | 23 | 694 | 2,439 | 20k+ | Non-prefixed hook name | ||
| #100 | WHMCS Bridge | 23 | 247 | 472 | 4k+ | Nonce verification recommended |
