WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_phpinfo
prevent path disclosure phpinfo
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | CM Tooltip Glossary | 27 | 611 | 188 | 7k+ | Output is not escaped | ||
| #52 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #53 | LWS Tools | 31 | 104 | 134 | 10k+ | Request data is not unslashed | ||
| #54 | System Dashboard | 32 | 91 | 205 | 900 | Request data is not unslashed | ||
| #55 | Wonder Slider Lite | 33 | 273 | 187 | 8k+ | Output is not escaped | ||
| #56 | WP Edit | 33 | 337 | 137 | 40k+ | Unsafe printing function | ||
| #57 | CM Search And Replace – Optimize content edits with a powerful search and replace tool | 34 | 286 | 111 | 2k+ | Output is not escaped | ||
| #58 | EasyIndex | 34 | 74 | 135 | 1k+ | Missing nonce verification | ||
| #59 | Security Safe | 34 | 193 | 164 | 700 | Missing Translators Comment | ||
| #60 | Shift8 CDN | 34 | 81 | 25 | 500 | Output is not escaped | ||
| #61 | Health Check & Troubleshooting | 35 | 264 | 238 | 300k+ | Missing Arg Domain | ||
| #62 | Instapage Plugin | 35 | 220 | 45 | 4k+ | Output is not escaped | ||
| #63 | WP Server Health Stats | 35 | 64 | 30 | 9k+ | Output is not escaped | ||
| #64 | WP System Information | 35 | 237 | 30 | 700 | Text Domain Mismatch | ||
| #65 | Prime Mover – Backup and Migration | 36 | 22 | 97 | 10k+ | Request data is not unslashed | ||
| #66 | WP Category Permalink | 37 | 75 | 31 | 2k+ | Output is not escaped | ||
| #67 | OpenHook | 39 | 172 | 22 | 1k+ | Unsafe printing function | ||
| #68 | Heroic Favicon Generator | 41 | 104 | 7 | 6k+ | Output is not escaped | ||
| #69 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #70 | Server Info – System Health & Diagnostics Suite | 50 | 15 | 46 | 3k+ | Input is not sanitized | ||
| #71 | Debug This | 52 | 43 | 32 | 2k+ | Missing Translators Comment | ||
| #72 | Pantheon Migrations | 57 | 15 | 26 | 1k+ | Output is not escaped | ||
| #73 | DreamHost Automated Migration | 62 | 15 | 23 | 20k+ | Output is not escaped | ||
| #74 | Migrate To Liquid Web & Nexcess | 62 | 15 | 23 | 2k+ | Output is not escaped | ||
| #75 | Pressable Automated Migration | 62 | 15 | 23 | 3k+ | Output is not escaped | ||
| #76 | Migrate to WordPress.com | 62 | 15 | 28 | 2k+ | Output is not escaped | ||
| #77 | DataFeedWatch Connector for WooCommerce | 64 | 16 | 112 | 600 | Non-prefixed hook name | ||
| #78 | WebDefender Security – Protection & AntiSpam | 70 | 176 | 61 | 1k+ | wp function not compatible with requires wp | ||
| #79 | Migrate Guru – Site Migration & Cloning | 81 | 7 | 8 | 200k+ | Database parameter is not escaped | ||
| #80 | BlogVault Backup & Staging | 82 | 54 | 26 | 80k+ | Missing direct file access protection | ||
| #81 | Cloudways WordPress Migrator | 82 | 6 | 9 | 20k+ | Database parameter is not escaped | ||
| #82 | MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall | 82 | 56 | 26 | 200k+ | Missing direct file access protection | ||
| #83 | The WP Remote WordPress Plugin | 82 | 52 | 28 | 30k+ | Missing direct file access protection | ||
| #84 | PHP Info | 84 | 8 | 5 | 600 | Output is not escaped | ||
| #85 | Cloudways Site Manager | 91 | 14 | 7 | 20k+ | wp function not compatible with requires wp | ||
| #86 | PHP Server Configuration | 98 | 2 | 1 | 400 | outdated tested upto header |
