PluginScore

WordPress.Security.NonceVerification.Missing

Missing nonce verification

A request handler uses request data without verifying that the request was intentionally created by WordPress.

critical weight

Why It Shows Up

The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.

Why It Matters

Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.

How to Fix

  • Add a nonce to the form, link, AJAX request, or REST request.
  • Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
  • Keep capability checks separate; nonces prove intent, not permission.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#751YMC Filter24121,7294k+Non-prefixed global variable
#752Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15230k+Non-prefixed global variable
#7533DPrint Lite251751,029700Non-prefixed global variable
#754AdRotate Banner Manager251,36384620k+Unsafe printing function
#755AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing256651,48610k+Non-prefixed global variable
#756Affiliates256891,4832k+Output is not escaped
#757FiboSearch – Ajax Search for WooCommerce25603302100k+Output is not escaped
#758AliExpress Dropshipping Plugin for WooCommerce Stores255507285k+Text Domain Mismatch
#759AIO Forms – Craft Complex Forms Easily25189418700Mixed line endings
#760Booking for Appointments and Events Calendar – Amelia251,48748090k+Exception output is not escaped
#761Appointment Booking Calendar253271,0551k+Non-prefixed global variable
#762Appointment Hour Booking – Booking Calendar252621,25310k+Non-prefixed global variable
#763ATUM WooCommerce Inventory Management and Stock Tracking252,6381,30410k+Non Singular String Literal Domain
#764bbp style pack251,4191,7916k+Output is not escaped
#765Beaver Builder Page Builder – Drag and Drop Website Builder254,4631,819100k+Text Domain Mismatch
#766Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid2524385450k+Non-prefixed global variable
#767Booking Activities251,0361,4693k+Output is not escaped
#768Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment252601,5611k+Non-prefixed global variable
#769Booking Calendar Contact Form25371884500Input is not validated
#770Booking Package251,6973,97710k+Missing nonce verification
#771Bookit — Booking & Appointment Calendar255651,4584k+Non-prefixed global variable
#772Online Scheduling and Appointment Booking System – Bookly251,08888860k+SQL query is not prepared
#773Breeze Cache25218800400k+Non-prefixed global variable
#774Broken Link Checker25727600500k+Output is not escaped
#775BuddyPress Docs252844217k+Nonce verification recommended
#776Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor251,0411,0164k+Text Domain Mismatch
#777Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#778PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus253621,586100k+Non-prefixed global variable
#779GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time256141,43140k+Non-prefixed global variable
#780CheckoutWC Lite251,3998523k+Text Domain Mismatch
#781CheckView – Form & Checkout Testing25663371k+Direct Query
#782Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#783Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode25991,040700k+Non-prefixed global variable
#784Disable Comments & Delete All Comments255031859k+Output is not escaped
#785Coinbase Business Gateway for WooCommerce255691,317800Non-prefixed global variable
#786Contact Form Email254098989k+Non-prefixed global variable
#787Coupon Creator256984121k+Output is not escaped
#788CP Contact Form with PayPal25466936800Unsafe printing function
#789Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#790CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#791Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#792DecaLog259432361k+Exception output is not escaped
#793Demo Importer Plus255823910k+Non-prefixed hook name
#794Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#795Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#796ELEX WooCommerce Dynamic Pricing and Discounts25478748800Text Domain Mismatch
#797WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#798Show Eventbrite Events – Event Feed for Eventbrite255951,525900Non-prefixed global variable
#799Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#800Events Made Easy255216,3241k+Non-prefixed function