WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3601 | Digital Signature For Contact Form 7 | 84 | 22 | 11 | 5k+ | file system operations fwrite | ||
| #3602 | Enable Turnstile (Cloudflare) for Gravity Forms | 84 | 8 | 7 | 700 | Missing direct file access protection | ||
| #3603 | Filterable Portfolio | 84 | 3 | 76 | 1k+ | Non-prefixed global variable | ||
| #3604 | Floating Publish Button | 84 | 5 | 4 | 1k+ | Unsafe printing function | ||
| #3605 | Mailster reCaptcha | 84 | 4 | 15 | 1k+ | Missing nonce verification | ||
| #3606 | Video Gallery YouTube Vimeo with Youtube API | 84 | 2 | 181 | 1k+ | Non-prefixed global variable | ||
| #3607 | PW WooCommerce Exclude Free Shipping | 84 | 1 | 12 | 1k+ | Missing nonce verification | ||
| #3608 | Safelayout Cute Preloader – CSS3 WordPress Preloader | 84 | 3 | 14 | 10k+ | Input is not validated | ||
| #3609 | Simple Testimonials Showcase | 84 | 33 | 11 | 500 | Missing Translators Comment | ||
| #3610 | Upload SVG | 84 | 3 | 8 | 1k+ | Non-prefixed global variable | ||
| #3611 | Widgets for Google Reviews and Ratings | 84 | 2 | 10 | 2k+ | Missing nonce verification | ||
| #3612 | Logo Slider and Showcase | 84 | 2 | 15 | 7k+ | Missing nonce verification | ||
| #3613 | DCO Comment Attachment | 85 | 5 | 5 | 5k+ | Missing nonce verification | ||
| #3614 | reCaptcha Add-On for FormCraft | 85 | 4 | 16 | 7k+ | Missing Version | ||
| #3615 | HSTS Ready | 85 | 3 | 11 | 3k+ | Input is not validated | ||
| #3616 | Ocean Stick Anything | 85 | 6 | 6 | 20k+ | Missing Arg Domain | ||
| #3617 | Widget CSS Classes | 85 | 47 | 8 | 80k+ | Non Singular String Literal Domain | ||
| #3618 | WPC Estimated Delivery Date for WooCommerce | 85 | 67 | 10k+ | Non-prefixed global variable | |||
| #3619 | WPC Variations Table for WooCommerce | 85 | 34 | 400 | Non-prefixed hook name | |||
| #3620 | HD Quiz – Save Results Light | 86 | 4 | 8 | 1k+ | Missing nonce verification | ||
| #3621 | LWS Affiliation | 86 | 8 | 23 | 700 | Missing nonce verification | ||
| #3622 | Nice page transition | 86 | 4 | 12 | 1k+ | Direct Query | ||
| #3623 | Microsoft Azure Storage for WordPress | 86 | 25 | 26 | 2k+ | Missing Translators Comment | ||
| #3624 | Sold Individually for WooCommerce Product Variations | 86 | 2 | 6 | 800 | Missing nonce verification | ||
| #3625 | Apaczka.pl Mapa Punktów | 87 | 8 | 9 | 2k+ | Missing nonce verification | ||
| #3626 | Contact Form 7 Spam Killer | 87 | 1 | 21 | 4k+ | Missing nonce verification | ||
| #3627 | Simple Photo Feed | 87 | 4 | 48 | 1k+ | Non-prefixed global variable | ||
| #3628 | Slug or PostID | 87 | 3 | 4 | 600 | Missing nonce verification | ||
| #3629 | Autocomplete Location Field for Contact Form 7 | 88 | 3 | 9 | 1k+ | Missing nonce verification | ||
| #3630 | Customizer Reset – Export & Import | 88 | 6 | 9 | 900 | wp function not compatible with requires wp | ||
| #3631 | NS Category Widget | 88 | 1 | 17 | 1k+ | Missing nonce verification | ||
| #3632 | WPC Admin Columns | 88 | 30 | 1k+ | Direct Query | |||
| #3633 | Raychat | 89 | 1 | 11 | 800 | Discouraged text-domain loading | ||
| #3634 | Location Pack for WooCommerce | 89 | 14 | 800 | Non-prefixed global variable | |||
| #3635 | MyRewards | 89 | 1,213 | 5 | 2k+ | Text Domain Mismatch | ||
| #3636 | WP Featherlight Disabled | 89 | 5 | 11 | 2k+ | trademarked term | ||
| #3637 | Duplicate PP | 90 | 8 | 10k+ | Non-prefixed constant | |||
| #3638 | Page and Post Restriction | 90 | 14 | 3 | 2k+ | wp function not compatible with requires wp | ||
| #3639 | Antispam for Elementor Forms | 91 | 3 | 3 | 1k+ | Missing Translators Comment | ||
| #3640 | Simple Honeypot for Contact Form 7 | 91 | 1 | 6 | 500 | Missing nonce verification | ||
| #3641 | SearchWP Modal Search Form | 91 | 9 | 9 | 5k+ | trademarked term | ||
| #3642 | Min Max Quantities – Set Minimum/Maximum Quantity & Price Limits with Step Control for WooCommerce | 91 | 2 | 30 | 10k+ | Non-prefixed hook name | ||
| #3643 | Range Slider Addon for Gravity Forms | 92 | 3 | 1k+ | Missing nonce verification | |||
| #3644 | Taboola Pixel | 92 | 1 | 5 | 500 | Missing nonce verification | ||
| #3645 | Disable WP REST API | 93 | 7 | 30k+ | Missing nonce verification | |||
| #3646 | Generate PDF using Contact Form 7 | 93 | 3 | 4k+ | Input is not sanitized | |||
| #3647 | Import Shopify To WP | 93 | 7 | 5 | 900 | Missing Translators Comment | ||
| #3648 | Smart Phone Field For WPForms, Contact Form 7, Fluent Forms, Elementor Forms, WooCommerce, Formidable Forms | 93 | 6 | 44 | 1k+ | Non-prefixed global variable | ||
| #3649 | Automatically Update Permalinks | 94 | 2 | 2 | 2k+ | Missing nonce verification | ||
| #3650 | Conditional Fields for Elementor Form – Apply Conditional Logic | 94 | 7 | 10k+ | Missing nonce verification |
