missing_direct_file_access_protection
Missing direct file access protection
A PHP file in the plugin can be loaded directly instead of through WordPress.
Why It Shows Up
Plugin Check found a PHP file without an early guard such as an ABSPATH check. Without that guard, a browser or script can request the file by path.
Why It Matters
Direct access can run code outside the normal WordPress bootstrap, expose output, or trigger assumptions about loaded functions, permissions, and request context.
How to Fix
- Add a guard near the top of PHP files that are not intended to be requested directly.
- Use `if ( ! defined( 'ABSPATH' ) ) { exit; }` before the file performs work or sends output.
- Keep template partials and bootstrap files protected too, not only the main plugin file.
Notes
- Files that are deliberately public endpoints should route through WordPress APIs or explicitly validate the request before doing work.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #5501 | Template Kit – Export | 83 | 7 | 90 | 8k+ | Non-prefixed global variable | ||
| #5502 | Term Duplicator | 83 | 5 | 6 | 500 | Input is not sanitized | ||
| #5503 | Unlist Posts & Pages | 83 | 5 | 9 | 10k+ | Nonce verification recommended | ||
| #5504 | SKU Label Changer For WooCommerce | 83 | 8 | 11 | 700 | Missing direct file access protection | ||
| #5505 | Stickers for WooCommerce | 83 | 952 | 14 | 3k+ | wp function not compatible with requires wp | ||
| #5506 | WP BASIC Auth | 83 | 4 | 13 | 4k+ | Input is not sanitized | ||
| #5507 | Image Gallery Block – Photo Gallery, Masonry & Lightbox | 84 | 9 | 22 | 2k+ | Non-prefixed global variable | ||
| #5508 | Acme Demo Setup | 84 | 8 | 6 | 10k+ | Non-prefixed function | ||
| #5509 | Campo RUT para CF7 | 84 | 6 | 7 | 600 | Missing nonce verification | ||
| #5510 | Add Descendants As Submenu Items | 84 | 3 | 8 | 2k+ | Missing nonce verification | ||
| #5511 | Aimogen – AI Content Writer, Chatbot, Editor and AI Automation for WordPress | 84 | 12 | 34 | 400 | Not In Footer | ||
| #5512 | AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations | 84 | 88 | 20 | 3k+ | Text Domain Mismatch | ||
| #5513 | Dynific Addons for Elementor (formerly AnyWhere Elementor) | 84 | 33 | 5 | 70k+ | Text Domain Mismatch | ||
| #5514 | Append extensions on Pages | 84 | 7 | 3 | 800 | Missing direct file access protection | ||
| #5515 | Astra Theme Visual Hooks | 84 | 54 | 5 | 2k+ | Text Domain Mismatch | ||
| #5516 | Change Admin Email | 84 | 4 | 4 | 50k+ | Missing nonce verification | ||
| #5517 | ClickShip | 84 | 13 | 5 | 1k+ | Output is not escaped | ||
| #5518 | Crazy Egg | 84 | 12 | 1 | 7k+ | wp function not compatible with requires wp | ||
| #5519 | WP All Import – Import Add-On for ACF | 84 | 3 | 46 | 50k+ | Non-prefixed global variable | ||
| #5520 | Digital Signature For Contact Form 7 | 84 | 22 | 11 | 5k+ | file system operations fwrite | ||
| #5521 | Enable Turnstile (Cloudflare) for Gravity Forms | 84 | 8 | 7 | 700 | Missing direct file access protection | ||
| #5522 | Events Calendar for Google | 84 | 13 | 8 | 2k+ | Missing direct file access protection | ||
| #5523 | Filterable Portfolio | 84 | 3 | 76 | 1k+ | Non-prefixed global variable | ||
| #5524 | FlippingBook | 84 | 14 | 6 | 2k+ | Missing Translators Comment | ||
| #5525 | Floating Button – Easily Create Sticky, Fixed & Floating Buttons | 84 | 6 | 184 | 4k+ | Non-prefixed global variable | ||
| #5526 | Floating Publish Button | 84 | 5 | 4 | 1k+ | Unsafe printing function | ||
| #5527 | Genesis Simple Hooks | 84 | 14 | 1 | 20k+ | Output is not escaped | ||
| #5528 | Get the Image | 84 | 8 | 8 | 7k+ | Non-prefixed hook name | ||
| #5529 | Stape Conversion Tracking | 84 | 23 | 4 | 10k+ | Non Singular String Literal Domain | ||
| #5530 | Lightweight Cookie Notice – Cookie Banner for Cookie Consent | 84 | 8 | 18 | 5k+ | Database parameter is not escaped | ||
| #5531 | Mailster reCaptcha | 84 | 4 | 15 | 1k+ | Missing nonce verification | ||
| #5532 | Nav Menu Roles | 84 | 3 | 18 | 70k+ | Non-prefixed hook name | ||
| #5533 | Ocean Social Sharing | 84 | 10 | 36 | 60k+ | Non-prefixed global variable | ||
| #5534 | Public Post Preview Configurator | 84 | 14 | 6 | 10k+ | Non Singular String Literal Domain | ||
| #5535 | Replace Image | 84 | 5 | 13 | 8k+ | Input is not sanitized | ||
| #5536 | Search by ID | 84 | 3 | 5 | 700 | Input is not sanitized | ||
| #5537 | SearchIQ – The Search Solution | 84 | 7 | 18 | 1k+ | Database parameter is not escaped | ||
| #5538 | Simple Testimonials Showcase | 84 | 33 | 11 | 500 | Missing Translators Comment | ||
| #5539 | SlickNav Mobile Menu | 84 | 13 | 0 | 3k+ | Output is not escaped | ||
| #5540 | Ultra Addons Lite for Elementor | 84 | 30 | 18 | 700 | wp function not compatible with requires wp | ||
| #5541 | UTMs Carry Pages | 84 | 4 | 11 | 400 | Non-prefixed global variable | ||
| #5542 | Web Stories | 84 | 12 | 63 | 60k+ | Non-prefixed global variable | ||
| #5543 | Easy Duplicate Product for WooCommerce | 84 | 7 | 8 | 3k+ | Missing direct file access protection | ||
| #5544 | WP PDF Generator | 84 | 21 | 22 | 1k+ | Request data is not unslashed | ||
| #5545 | wpautop control | 84 | 7 | 5 | 1k+ | trademarked term | ||
| #5546 | WPB Accordion Menu – Collapsible Vertical Sidebar Menu – WooCommerce Category Accordion | 84 | 5 | 59 | 10k+ | Non-prefixed hook name | ||
| #5547 | WPLANG Lite | 84 | 8 | 5 | 400 | trademarked term | ||
| #5548 | WPML Shortcodes | 84 | 7 | 12 | 900 | Non-prefixed function | ||
| #5549 | Wrap form fields in Gravity Forms | 84 | 22 | 3 | 1k+ | Text Domain Mismatch | ||
| #5550 | Advanced Post Manager | 85 | 11 | 18 | 4k+ | Request data is not unslashed |
