Before WordPress core had AJAX plugin actions, uninstallation in register_uninstall_hook() worked fine:

 if ( ! current_user_can( 'activate_plugins' ) )

 check_admin_referer( 'bulk-plugins' );

It needs a real HTTP/POST, so if you you disable JavaScript in your browser on WP 4.9 it works.

But it fails with AJAX plugin uninstallation with Are you sure you want to do this? I'd like to keep up strong security.

What is the solution? What is the AJAX counterpart of check_admin_referer( 'bulk-plugins' ) in plugin uninstallation?


  • Since you already asked that on Slack, have you read the reply there? – swissspidy Feb 3 '18 at 7:51
  • Yes. I'll add the answer here too. – Szépe Viktor Feb 4 '18 at 9:06
  • For a plugins there is no need to check user capabilities or nonces, core takes care about that. – Szépe Viktor Feb 4 '18 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.