WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_phpinfo
prevent path disclosure phpinfo
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | Intercom | 0 | 60 | 71 | 6k+ | Non-prefixed function | ||
| #3 | Live Shopping & Shoppable Videos For WooCommerce | 0 | 79 | 174 | 400 | Non-prefixed global variable | ||
| #4 | WPPizza – A Restaurant Plugin | 18 | 4,689 | 2,703 | 1k+ | Text Domain Mismatch | ||
| #5 | Event Espresso – Event Registration & Ticketing Sales | 20 | 12,698 | 2,135 | 600 | Text Domain Mismatch | ||
| #6 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 556 | 543 | 100k+ | Output is not escaped | ||
| #7 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | Output is not escaped | ||
| #8 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,511 | 2,669 | 10k+ | Non-prefixed global variable | ||
| #9 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,592 | 2,973 | 5m+ | Output is not escaped | ||
| #10 | WP-Lister Lite for eBay | 21 | 6,697 | 5,129 | 2k+ | Output is not escaped | ||
| #11 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 50k+ | Missing Arg Domain | ||
| #12 | Diverse Solutions IDX Real Estate Listings & MLS Search | 22 | 745 | 605 | 1k+ | Heredoc Output Not Escaped | ||
| #13 | E2Pdf – Export Pdf Tool for WordPress | 22 | 1,081 | 847 | 10k+ | Unsafe printing function | ||
| #14 | Newsletters | 22 | 2,976 | 2,257 | 2k+ | Text Domain Mismatch | ||
| #15 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,272 | 2,063 | 100k+ | Non-prefixed global variable | ||
| #16 | Packeta | 22 | 801 | 333 | 8k+ | Exception output is not escaped | ||
| #17 | Stylish Price List – Price Table Builder & QR Code Restaurant Menu | 22 | 674 | 678 | 3k+ | Output is not escaped | ||
| #18 | Unlimited Elements Blocks Library | 22 | 708 | 1,822 | 400 | Non-prefixed global variable | ||
| #19 | Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links | 22 | 1,044 | 1,797 | 20k+ | Non-prefixed global variable | ||
| #20 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 970 | 999 | 80k+ | Exception output is not escaped | ||
| #21 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | Exception output is not escaped | ||
| #22 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | Exception output is not escaped | ||
| #23 | Ecwid by Lightspeed Ecommerce Shopping Cart | 23 | 339 | 307 | 20k+ | Missing direct file access protection | ||
| #24 | InfiniteWP Client | 23 | 2,287 | 1,811 | 200k+ | Exception output is not escaped | ||
| #25 | Joli FAQ SEO – WordPress FAQ Plugin | 23 | 1,083 | 1,526 | 700 | Non-prefixed global variable | ||
| #26 | Justified Gallery | 23 | 589 | 1,417 | 8k+ | Non-prefixed global variable | ||
| #27 | Unlimited Elements For Elementor | 23 | 711 | 2,101 | 300k+ | Non-prefixed global variable | ||
| #28 | ManageWP Worker | 23 | 506 | 565 | 1m+ | Non-prefixed class | ||
| #29 | WP-Lister Lite for Amazon | 23 | 3,061 | 4,177 | 800 | Output is not escaped | ||
| #30 | Builderall for WordPress | 24 | 4,778 | 1,307 | 1k+ | Text Domain Mismatch | ||
| #31 | CM Pop-Up – Create engaging popups to capture attention and boost interaction | 24 | 466 | 408 | 8k+ | Output is not escaped | ||
| #32 | Etsy Integration For WooCommerce | 24 | 1,246 | 4,643 | 900 | Non-prefixed global variable | ||
| #33 | Joli Table Of Contents | 24 | 653 | 1,755 | 7k+ | Non-prefixed global variable | ||
| #34 | WPeMatico RSS Feed Fetcher | 24 | 1,378 | 587 | 10k+ | Output is not escaped | ||
| #35 | XT Ajax Add To Cart for WooCommerce | 24 | 985 | 1,665 | 1k+ | Non-prefixed global variable | ||
| #36 | XT Variation Swatches for WooCommerce | 24 | 1,033 | 1,809 | 500 | Non-prefixed global variable | ||
| #37 | Beaver Builder Page Builder – Drag and Drop Website Builder | 25 | 4,463 | 1,819 | 100k+ | Text Domain Mismatch | ||
| #38 | Online Scheduling and Appointment Booking System – Bookly | 25 | 1,095 | 900 | 60k+ | SQL query is not prepared | ||
| #39 | DecaLog | 25 | 943 | 236 | 1k+ | Exception output is not escaped | ||
| #40 | ELEX WooCommerce Dynamic Pricing and Discounts | 25 | 478 | 748 | 800 | Text Domain Mismatch | ||
| #41 | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | 25 | 876 | 1,798 | 100k+ | Non-prefixed global variable | ||
| #42 | Hardcore Google Fonts Localizer | 25 | 331 | 261 | 800 | Text Domain Mismatch | ||
| #43 | Index WP MySQL For Speed | 25 | 250 | 255 | 50k+ | Output is not escaped | ||
| #44 | phpinfo() WP – Site Health, PHP Compatibility & Server Audit | 25 | 909 | 722 | 3k+ | Non-prefixed global variable | ||
| #45 | Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator | 25 | 648 | 1,021 | 1k+ | Output is not escaped | ||
| #46 | XT Floating Cart for WooCommerce | 25 | 1,232 | 1,985 | 4k+ | Non-prefixed global variable | ||
| #47 | XT Quick View for WooCommerce | 25 | 1,062 | 1,798 | 400 | Non-prefixed global variable | ||
| #48 | Kadence Central – Site Management, Backups, Security, and Reporting | 26 | 462 | 213 | 30k+ | Text Domain Mismatch | ||
| #49 | Amazon Product in a Post Plugin | 27 | 362 | 416 | 800 | Output is not escaped | ||
| #50 | Custom Scrollbar | 27 | 184 | 191 | 2k+ | Output is not escaped |
