WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting
prevent path disclosure error reporting
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #201 | AJAX Login and Registration modal popup + inline form | 28 | 157 | 261 | 3k+ | Output is not escaped | ||
| #202 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 96 | 700 | Non Singular String Literal Domain | ||
| #203 | Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | 28 | 145 | 259 | 5k+ | Post Not In exclude | ||
| #204 | Autopay | 28 | 769 | 334 | 3k+ | Text Domain Mismatch | ||
| #205 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #206 | WP YouTube Lyte | 28 | 204 | 178 | 30k+ | Non-prefixed global variable | ||
| #207 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #208 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #209 | FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider | 29 | 74 | 78 | 600k+ | Missing Translators Comment | ||
| #210 | Post Timeline | 29 | 91 | 200 | 800 | Missing nonce verification | ||
| #211 | Sofortueberweisung Gateway for Woocommerce | 29 | 104 | 71 | 700 | Output is not escaped | ||
| #212 | Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management | 29 | 53 | 496 | 3k+ | Direct Query | ||
| #213 | Edwiser Bridge – WordPress Moodle Integration | 30 | 4 | 669 | 4k+ | Non-prefixed hook name | ||
| #214 | Epeken All Kurir for Woocommerce | 30 | 590 | 1,246 | 500 | Missing nonce verification | ||
| #215 | Naver webmaster syndication v2 | 30 | 89 | 129 | 500 | Output is not escaped | ||
| #216 | Delivery & Pickup Date Time for WooCommerce | 30 | 439 | 435 | 5k+ | Non-prefixed global variable | ||
| #217 | WCPOS – Point of Sale (POS) plugin for WooCommerce | 30 | 77 | 228 | 5k+ | Nonce verification recommended | ||
| #218 | Яндекс Доставка (Boxberry) | 31 | 46 | 150 | 600 | Missing nonce verification | ||
| #219 | FastDup – Fastest WordPress Migration & Duplicator | 31 | 83 | 66 | 5k+ | wp function not compatible with requires wp | ||
| #220 | Query Monitor | 31 | 44 | 273 | 200k+ | Non-prefixed class | ||
| #221 | Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | 31 | 837 | 295 | 100k+ | Unsafe printing function | ||
| #222 | WP Easy Uploader | 31 | 202 | 113 | 600 | Non Singular String Literal Domain | ||
| #223 | Better Robots.txt – AI-Ready Crawl Control & Bot Governance | 32 | 55 | 83 | 5k+ | error log error log | ||
| #224 | BuddyPress for LearnDash | 32 | 190 | 284 | 1k+ | Output is not escaped | ||
| #225 | Child Theme Configurator | 32 | 442 | 267 | 300k+ | Unsafe printing function | ||
| #226 | Translate WordPress with GTranslate | 32 | 82 | 364 | 900k+ | Non-prefixed global variable | ||
| #227 | HTML5 jQuery Audio Player | 32 | 251 | 153 | 1k+ | Unsafe printing function | ||
| #228 | MapPress Maps for WordPress | 32 | 695 | 133 | 30k+ | Missing Arg Domain | ||
| #229 | Muslim Prayer Time-Salah/Iqamah | 32 | 155 | 179 | 400 | date date | ||
| #230 | Showcase IDX Real Estate Search & Lead Capture | 32 | 123 | 52 | 2k+ | Output is not escaped | ||
| #231 | System Dashboard | 32 | 91 | 205 | 1k+ | Request data is not unslashed | ||
| #232 | Agile CRM | 33 | 163 | 81 | 600 | wp function not compatible with requires wp | ||
| #233 | LWSCache | 33 | 47 | 104 | 6k+ | Non-prefixed global variable | ||
| #234 | Molongui Post Contributors: Multi-Role Contributor Attribution | 33 | 240 | 162 | 400 | Output is not escaped | ||
| #235 | Zita Site Library for Elementor | 33 | 107 | 135 | 1k+ | Text Domain Mismatch | ||
| #236 | Assistant – Every Day Productivity Apps | 34 | 124 | 97 | 4k+ | Exception output is not escaped | ||
| #237 | SMS Abandoned Cart Recovery ✦ CartBoss | 34 | 67 | 72 | 400 | SQL query is not prepared | ||
| #238 | EasyIndex | 34 | 74 | 135 | 1k+ | Missing nonce verification | ||
| #239 | Image Cleanup | 34 | 52 | 94 | 1k+ | Nonce verification recommended | ||
| #240 | Pix Automático com Pagarme para WooCommerce | 34 | 68 | 66 | 500 | Non-prefixed global variable | ||
| #241 | Disable XML-RPC-API | 35 | 444 | 52 | 100k+ | Text Domain Mismatch | ||
| #242 | Editorial Calendar | 35 | 127 | 160 | 20k+ | Output is not escaped | ||
| #243 | Force Regenerate Thumbnails | 35 | 12 | 17 | 200k+ | unlink unlink | ||
| #244 | Get a Newsletter | 35 | 138 | 144 | 400 | Output is not escaped | ||
| #245 | Gumlet – Image optimization with Resize, Compression, Lazy load, Caching & CDN delivery | 35 | 53 | 45 | 500 | parse url parse url | ||
| #246 | Planyo online reservation system | 35 | 64 | 90 | 400 | Output is not escaped | ||
| #247 | Security Optimizer – The All-In-One Protection Plugin | 35 | 40 | 84 | 1m+ | Request data is not unslashed | ||
| #248 | Two Factor Authentication | 35 | 108 | 139 | 20k+ | Output is not escaped | ||
| #249 | Custom Body Class | 35 | 39 | 101 | 10k+ | Non-prefixed global variable | ||
| #250 | Year Make Model Search for WooCommerce | 35 | 188 | 162 | 1k+ | Output is not escaped |
