Request data is not unslashed

Why It Shows Up

WordPress adds slashes to request data for historical compatibility. The scan found `$_GET`, `$_POST`, `$_REQUEST`, or similar input used without `wp_unslash()`.

Why It Matters

Sanitizing slashed data can produce incorrect values, failed comparisons, broken validation, or stored data that does not match what the user submitted.

How to Fix

• Read the specific request key, then call `wp_unslash()` on it.
• Sanitize the unslashed value with a function that matches the expected data type.
• Validate the sanitized value before using it in permissions, queries, redirects, or stored settings.

References