missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5201 | Ceylon Extra | 77 | 89 | 41 | 500 | Text Domain Mismatch | ||
| #5202 | ELEX Hide WooCommerce Shipping Methods | 77 | 83 | 54 | 1k+ | Text Domain Mismatch | ||
| #5203 | FD Footnotes Plugin | 77 | 28 | 5 | 1k+ | Non Singular String Literal Domain | ||
| #5204 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 77 | 37 | 282 | 40k+ | Non-prefixed global variable | ||
| #5205 | WP-FormAssembly | 77 | 4 | 15 | 2k+ | Nonce verification recommended | ||
| #5206 | f(x) Editor | 77 | 14 | 3 | 1k+ | Unsafe printing function | ||
| #5207 | GDPR | 77 | 39 | 121 | 10k+ | Non-prefixed global variable | ||
| #5208 | Embed Files from Google Drive | 77 | 4 | 35 | 5k+ | Nonce verification recommended | ||
| #5209 | Gravity Forms Auto Placeholders | 77 | 9 | 8 | 700 | trademarked term | ||
| #5210 | Index WP Users For Speed | 77 | 10 | 35 | 1k+ | Non-prefixed global variable | ||
| #5211 | Mailster Mailgun Integration | 77 | 16 | 5 | 500 | Missing Translators Comment | ||
| #5212 | Master QR Code Generator – Fast & Easy QR Code Creator | 77 | 21 | 59 | 400 | Non-prefixed global variable | ||
| #5213 | PDF Smart Viewer for Elementor | 77 | 18 | 16 | 1k+ | Non-prefixed global variable | ||
| #5214 | Posts List | 77 | 11 | 15 | 7k+ | Non-prefixed hook name | ||
| #5215 | Pushover Integration for WooCommerce | 77 | 107 | 7 | 800 | Text Domain Mismatch | ||
| #5216 | Remove Taxonomy Slug | 77 | 23 | 2 | 400 | Output is not escaped | ||
| #5217 | Responsive Tabs For Elementor | 77 | 57 | 27 | 1k+ | Text Domain Mismatch | ||
| #5218 | Scroll Magic Addon for Elementor | 77 | 344 | 7 | 400 | Text Domain Mismatch | ||
| #5219 | Shipping Zone Duplicator for WooCommerce | 77 | 10 | 14 | 800 | Nonce verification recommended | ||
| #5220 | Display custom fields in the frontend – Post and User Profile Fields | 77 | 17 | 18 | 600 | Non-prefixed global variable | ||
| #5221 | Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads | 77 | 17 | 1 | 10k+ | Exception output is not escaped | ||
| #5222 | Supreme Google Webfonts | 77 | 12 | 7 | 1k+ | Text Domain Mismatch | ||
| #5223 | SureRank SEO – Smart Assistant with Meta Tags, Social Preview, XML Sitemap, and Schema | 77 | 58 | 95 | 300k+ | Non-prefixed hook name | ||
| #5224 | Table Of Contents Block | 77 | 15 | 8 | 10k+ | wp function not compatible with requires wp | ||
| #5225 | Tagembed Social Feeds Widget | 77 | 21 | 137 | 10k+ | Non-prefixed function | ||
| #5226 | Taggbox – Free Social Media Widgets, Review Badges & Shoppable UGC | 77 | 23 | 113 | 1k+ | Direct Query | ||
| #5227 | Template Kit – Import | 77 | 41 | 60 | 400k+ | Non-prefixed global variable | ||
| #5228 | Toggle wpautop | 77 | 4 | 15 | 9k+ | trademarked term | ||
| #5229 | Unattach | 77 | 4 | 11 | 900 | Nonce verification recommended | ||
| #5230 | Username | 77 | 5 | 8 | 600 | Deprecated function: screen_icon | ||
| #5231 | Widget Classes | 77 | 5 | 7 | 1k+ | Missing nonce verification | ||
| #5232 | Lorem Ipsum Generator | 77 | 7 | 9 | 500 | Missing direct file access protection | ||
| #5233 | WP Night Mode | 77 | 8 | 11 | 700 | Non-prefixed function | ||
| #5234 | WP Upload Size | 77 | 6 | 14 | 2k+ | Non-prefixed function | ||
| #5235 | wpsection | 77 | 131 | 554 | 3k+ | Non-prefixed global variable | ||
| #5236 | X-Currency – The Ultimate WooCommerce currency switcher for a smoother shopping experience | 77 | 17 | 77 | 1k+ | Non-prefixed global variable | ||
| #5237 | Accordion Blocks | 78 | 9 | 3 | 10k+ | Unsafe printing function | ||
| #5238 | Support For Icomoon with Advanced Custom Fields | 78 | 15 | 6 | 1k+ | Output is not escaped | ||
| #5239 | ELEX WooCommerce Address Validation & Google Address Autocomplete Plugin | 78 | 73 | 40 | 700 | Missing Arg Domain | ||
| #5240 | AffiliateWP – Affiliate QR Codes | 78 | 32 | 8 | 1k+ | Text Domain Mismatch | ||
| #5241 | AffiliateWP – Allow Own Referrals | 78 | 37 | 10 | 500 | Text Domain Mismatch | ||
| #5242 | AI Provider for Anthropic | 78 | 13 | 1 | 30k+ | Exception output is not escaped | ||
| #5243 | Animated Text Block – Add Typing and Looping Text Effects | 78 | 5 | 25 | 4k+ | Non-prefixed class | ||
| #5244 | Biteship Shipping | 78 | 25 | 16 | 500 | wp function not compatible with requires wp | ||
| #5245 | Booking System Trafft | 78 | 3 | 19 | 400 | Nonce verification recommended | ||
| #5246 | Bookvault | 78 | 13 | 10 | 700 | Nonce verification recommended | ||
| #5247 | Player for SoundCloud – Embed and Play Audio Tracks | 78 | 17 | 24 | 1k+ | Text Domain Mismatch | ||
| #5248 | Floating Ads Bottom | 78 | 9 | 1 | 2k+ | Setting is missing a sanitization callback | ||
| #5249 | Forget About Shortcode Buttons | 78 | 11 | 25 | 20k+ | Missing direct file access protection | ||
| #5250 | Frontend Product Editor for WooCommerce | 78 | 76 | 31 | 400 | Text Domain Mismatch |
