PluginScore

WordPress.Security.NonceVerification.Missing

Missing nonce verification

A request handler uses request data without verifying that the request was intentionally created by WordPress.

critical weight

Why It Shows Up

The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.

Why It Matters

Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.

How to Fix

  • Add a nonce to the form, link, AJAX request, or REST request.
  • Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
  • Keep capability checks separate; nonces prove intent, not permission.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#3501Cálculo do frete somente com o CEP – WC Brasil7413241k+Non-prefixed function
#3502Signature Field For Contact Form 7 – CF7Sign74912700Missing Translators Comment
#3503CoinGate for WooCommerce743518400Text Domain Mismatch
#3504Contact Form 7 Email Validation748101k+Input is not validated
#3505EmailKit – Email Customizer for WooCommerce & WP74178270k+slow db query meta query
#3506Formidable Honeypot74106400Text Domain Mismatch
#3507Gravity Forms Multi Currency74612400Output is not escaped
#3508RD Station746520k+Non-prefixed global variable
#3509Keon Toolset7442830k+Non-prefixed function
#3510Multiple Admin Email Addresses74741k+Missing nonce verification
#3511Multiple Roles748185k+Non-prefixed global variable
#3512WP Term Colors74313700Nonce verification recommended
#3513Zion Builder – Website Builder for Speed & Creativity744291k+Non-prefixed hook name
#3514Beacon Lead Magnets and Lead Capture75825500Nonce verification recommended
#3515Delay Redirects7558900Request data is not unslashed
#3516En Spam75216500wp function not compatible with requires wp
#3517Force First and Last Name as Display Name755122k+Missing nonce verification
#3518Honeypot Anti Spam for Forminator Forms75471k+Missing nonce verification
#3519List all URLs75855k+Missing nonce verification
#3520Options Framework7585610k+Non-prefixed function
#3521Order Delivery Date And Time7526281k+Text Domain Mismatch
#3522reCAPTCHA for bbPress751419700Non-prefixed function
#3523Checkout & Store Toolkit for WooCommerce7521900Nonce verification recommended
#3524Custom Product Tabs Lite for WooCommerce753114k+Input is not validated
#3525Brazilian Market on WooCommerce7545170k+Missing nonce verification
#3526Addonify – WooCommerce Wishlist7630431k+Non-prefixed global variable
#3527Aruba Fatturazione Elettronica7634700Missing nonce verification
#3528Auction Nudge – Your eBay Listings761861k+Missing direct file access protection
#3529PiWeb Cancel order / Refund request for WooCommerce7640492k+wp function not compatible with requires wp
#3530Custom Template for LearnDash76791k+Non-prefixed hook name
#3531Input Masks for Contact Form 77614312800wp function not compatible with requires wp
#3532Leo Product Recommendations for WooCommerce76379400Short URL found
#3533ABC Crypto Checkout7642141k+Text Domain Mismatch
#3534Telephone Input For Contact Form 7761810600Text Domain Mismatch
#3535Contact Form 7 Text CAPTCHA7614341k+Non-prefixed global variable
#3536Breadcrumbs for WooCommerce761426k+Output is not escaped
#3537WP SAML Auth767257k+Nonce verification recommended
#3538WPC Free Gift Coupons for WooCommerce76419400Non-prefixed class
#3539Canonical SEO Content Syndication WordPress Plugin7748400Missing nonce verification
#3540Honeypot Plus for Contact Form 777317700Missing nonce verification
#3541GDPR773912110k+Non-prefixed global variable
#3542Photo & Video Gallery – Image, Video & Portfolio774101k+Missing Version
#3543Simple Floating Menu7713310k+Missing direct file access protection
#3544Username7758700Deprecated function: screen_icon
#3545Widget Classes77571k+Missing nonce verification
#3546WPC Show Single Variations for WooCommerce771261k+Nonce verification recommended
#3547wpsection771315543k+Non-prefixed global variable
#3548Instant AI Image Generator – Create & Import Images78231k+Non-prefixed constant
#3549Animated Text Block – Add Typing and Looping Text Effects785254k+Non-prefixed class
#3550Biteship Shipping782516500wp function not compatible with requires wp