PluginScore

WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_phpinfo

prevent path disclosure phpinfo

Development or debugging behavior appears in code that may run in production.

medium weight

Why It Shows Up

The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.

Why It Matters

Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.

How to Fix

  • Remove temporary debugging calls before release.
  • If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
  • Never show debug details to unauthenticated visitors or normal front-end users.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4Administrator Z182,061799400Output is not escaped
#5WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#6Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8791,9791m+Non-prefixed global variable
#7Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#8Event Espresso – Event Registration & Ticketing Sales2112,7102,136600Text Domain Mismatch
#9URL Shortify – Simple and Easy URL Shortener211,5092,73710k+Non-prefixed global variable
#10Wordfence Security – Firewall, Malware Scan, and Login Security211,8933,2925m+Output is not escaped
#11WP-Lister Lite for eBay216,7015,1402k+Output is not escaped
#12WP phpMyAdmin214,5286,43540k+Missing Arg Domain
#13Diverse Solutions IDX Real Estate Listings & MLS Search227456051k+Heredoc Output Not Escaped
#14E2Pdf – Export Pdf Tool for WordPress221,08185210k+Unsafe printing function
#15Newsletters222,9862,2542k+Text Domain Mismatch
#16NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2632,046100k+Non-prefixed global variable
#17Packeta228013418k+Exception output is not escaped
#18Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#19Unlimited Elements For Elementor227062,116300k+Non-prefixed global variable
#20Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0371,80920k+Non-prefixed global variable
#21WP Umbrella: Security Backup Restore & Monitoring221,0011,19180k+Exception output is not escaped
#22WP-WebAuthn229573962k+Exception output is not escaped
#23YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports221,36647710k+Offloaded Content
#24Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN233,42887770k+Text Domain Mismatch
#25InfiniteWP Client232,3791,844200k+Exception output is not escaped
#26Joli FAQ SEO – WordPress FAQ Plugin231,0831,526600Non-prefixed global variable
#27Justified Gallery235891,4178k+Non-prefixed global variable
#28Stylish Price List – Price Table Builder & QR Code Restaurant Menu236696793k+Output is not escaped
#29ManageWP Worker235015701m+Non-prefixed class
#30XT Ajax Add To Cart for WooCommerce239821,6661k+Non-prefixed global variable
#31XT Variation Swatches for WooCommerce231,0291,810500Non-prefixed global variable
#32Broken Link Checker24887733500k+Output is not escaped
#33Builderall for WordPress244,7781,3071k+Text Domain Mismatch
#34CM Pop-Up – Create engaging popups to capture attention and boost interaction244664088k+Output is not escaped
#35Defender Security – Malware Scanner, Login Security & Firewall241,3271,32980k+Non-prefixed namespace
#36Ecwid by Lightspeed Ecommerce Shopping Cart2433830720k+Missing direct file access protection
#37Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#38Forminator Forms – Contact Form, Payment Form & Custom Form Builder248381,304600k+Non-prefixed global variable
#39XT Floating Cart for WooCommerce241,2281,9864k+Non-prefixed global variable
#40WP-Lister Lite for Amazon243,0604,178800Output is not escaped
#41WPeMatico RSS Feed Fetcher241,38758610k+Output is not escaped
#42XT Quick View for WooCommerce241,0581,799300Non-prefixed global variable
#43Beaver Builder Page Builder – Drag and Drop Website Builder254,5561,997100k+Text Domain Mismatch
#44Online Scheduling and Appointment Booking System – Bookly251,16693360k+SQL query is not prepared
#45DecaLog259432361k+Exception output is not escaped
#46ELEX WooCommerce Dynamic Pricing and Discounts25478748800Text Domain Mismatch
#47Gallery : FooGallery256021,799100k+Non-prefixed global variable
#48Hardcore Google Fonts Localizer25331261800Text Domain Mismatch
#49Index WP MySQL For Speed2525025550k+Output is not escaped
#50Kadence Central – Site Management, Backups, Security, and Reporting2545121430k+Text Domain Mismatch