security-analysis

Domain 1: Security Audit

Evaluate the codebase and configuration against OWASP Top 10 and WordPress-specific vulnerability patterns.

1.1 Input Validation & Sanitization

• All user inputs pass through appropriate WordPress sanitization functions (sanitize_text_field(), sanitize_email(), absint(), wp_kses(), wp_kses_post())
• $_GET, $_POST, $_REQUEST, $_SERVER, $_COOKIE are never used directly without sanitization
• Database inputs use $wpdb->prepare() for all parameterized queries — no raw string concatenation in SQL
• File upload validation checks MIME type, extension, and file size using WordPress APIs
• esc_url() used for all URLs before output or redirect

1.2 Output Escaping

• All dynamic output escaped with context-appropriate functions:
  • HTML context: esc_html()
  • Attribute context: esc_attr()
  • JavaScript context: esc_js() or wp_json_encode()
  • URL context: esc_url()
  • Translation with escaping: esc_html__(), esc_html_e(), esc_attr__()
• Template files reviewed for raw echo of user-controlled data
• No use of eval(), assert(), preg_replace() with e modifier, or create_function()

1.3 Authentication & Authorization

• All AJAX handlers check check_ajax_referer() or equivalent nonce verification
• All form submissions verify nonces via wp_verify_nonce()
• REST API endpoints use permission_callback (never __return_true for sensitive operations)
• Capability checks (current_user_can()) before any privileged operation
• No hardcoded credentials, API keys, or secrets in source code
• Authentication cookies use httpOnly, Secure, and SameSite flags where applicable

1.4 Cross-Site Request Forgery (CSRF)

• Every form includes wp_nonce_field()
• Every form handler verifies nonce before processing
• AJAX actions use wp_create_nonce() / check_ajax_referer()
• State-changing operations never triggered by GET requests alone

1.5 SQL Injection

• All database queries use $wpdb->prepare() with proper placeholders (%s, %d, %f)
• No direct concatenation of variables into SQL strings
• LIKE queries use $wpdb->esc_like() followed by $wpdb->prepare()
• Custom table creation uses dbDelta() with proper schema
• No use of query() with unsanitized input