PluginScore

WordPress.Security.NonceVerification.Missing

Missing nonce verification

A request handler uses request data without verifying that the request was intentionally created by WordPress.

critical weight

Why It Shows Up

The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.

Why It Matters

Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.

How to Fix

  • Add a nonce to the form, link, AJAX request, or REST request.
  • Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
  • Keep capability checks separate; nonces prove intent, not permission.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#3551Animated Text Block – Add Typing and Looping Text Effects785254k+Non-prefixed class
#3552Biteship Shipping782516500wp function not compatible with requires wp
#3553Date Picker For Contact Form 778384k+Missing nonce verification
#3554Player for SoundCloud – Embed and Play Audio Tracks7817241k+Text Domain Mismatch
#3555Honeypot Anti-Spam785710k+Missing nonce verification
#3556More Mails for CF778136500Text Domain Mismatch
#3557Nav Menu Images78586k+Missing nonce verification
#3558Coming Soon & Maintenance Mode Page & Under Construction78356710k+Non-prefixed global variable
#3559PiWeb Min/Max Quantity & Minimum Order Limits for WooCommerce7841700Nonce verification recommended
#3560Post Order By Category78112900Missing nonce verification
#3561Typing Text – Add Animated Typing Effects to Headings or Text784253k+Non-prefixed class
#3562JSON API Auth79511700Non-prefixed function
#3563Manage Privacy Options Page793111k+Input is not validated
#3564Sellbrite79184500Short PHP open tag found
#3565SSH SFTP Updater Support7963110k+Non-prefixed global variable
#3566Customizer for WooCommerce794620k+Missing nonce verification
#3567WPC Additional Variation Images for WooCommerce79426800Non-prefixed class
#3568Custom Icons for Elementor8062510k+Non-prefixed global variable
#3569Eli's PHP Compatibility Scanner80122400Missing nonce verification
#3570Ailo – AI Slug Translator808141k+wp function not compatible with requires wp
#3571Image Captcha For Gravity Forms802010400Text Domain Mismatch
#3572Nudgify Social Proof80312500Discouraged PHP function
#3573Publish View80126500Missing nonce verification
#3574WP Video Popup – WordPress Video Lightbox for YouTube, Rumble & Vimeo805149k+wp function not compatible with requires wp
#3575Mini Cart Drawer For WooCommerce80425500Non-prefixed hook name
#3576Blocksy Companion811,069300k+Non-prefixed global variable
#3577ElasticPress81136558k+Non-prefixed hook name
#3578External Thumbnail816520k+Missing nonce verification
#3579Open in New Window Plugin81682k+Offloaded Content
#3580Payfast Gateway for WooCommerce812182k+Missing nonce verification
#3581Select and Multi-Select Field for Contact Form 78125122k+Text Domain Mismatch
#3582Orphans8114350k+Dynamic hook name
#3583WP Subtitle8173310k+Non-prefixed hook name
#3584Bookero.pl – system rezerwacji online821271k+curl curl setopt
#3585Confirm Plus Contact Form 78210157k+Non Singular String Literal Domain
#3586Iknow Extra8265400Missing direct file access protection
#3587Independent Analytics for MainWP82713700Nonce verification recommended
#3588OpenPix for WooCommerce826928500wp function not compatible with requires wp
#3589PixTypes821789k+Non-prefixed global variable
#3590Sucuri Security – Auditing, Malware Scanner and Security Hardening825111600k+Missing direct file access protection
#3591Unyson WooComerce Shortcodes82117111k+Text Domain Mismatch
#3592Extra Price Fields for Woocommerce- Display extra price info on Woocommerce products826102k+Missing nonce verification
#3593WP Copy Content Protection8276600Output is not escaped
#3594Max upload filesize83389k+Input is not validated
#3595morkva UA Shipping831,261101k+Text Domain Mismatch
#3596Preserve Editor Scroll Position83264k+Missing nonce verification
#3597Campo RUT para CF78467600Missing nonce verification
#3598Add Descendants As Submenu Items84382k+Missing nonce verification
#3599Bulk Post Importer84138900Missing nonce verification
#3600Change Admin Email844450k+Missing nonce verification