Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy to override these functions in a plugin so that all nonces are accepted as valid.

if( ! function_exists('wp_verify_nonce') ) {
  function wp_verify_nonce($nonce, $action = -1) {
    return 1;

I have tested this, and indeed, CSRF protection is now disabled site-wide. What's the reason that these functions are put in the pluggable.php file if the security risks are so obvious?

  • 1
    Maybe there's an answer here, haven't read the full page though... – brasofilo Mar 26 '13 at 11:27
  • Those comments show that (7 years ago) people wanted to implement their own nonce functionality. Nobody in there thought about the security risks involved when an untrusted source implements a downgraded version of the nonces, instead of a stronger one. – Honoki Mar 26 '13 at 11:34
  • 2
    That one is basically the only ticket dealing with the concept. Maybe you could reach a wider audience of developers in [wp-hackers] list and in Google+ group. – brasofilo Mar 26 '13 at 11:42

There is no security risk in a pluggable function: If someone installs a plugin that lowers the security it is his/her own fault. On the other hand, you can override the functions to make nonces more unique or to change their format.

In a custom function wp_verify_nonce() you could use an optional third parameter or change the time a nonce expires.

Nowadays pluggable functions aren't introduced anymore. They are hard to debug, and you can do the same with filters usually. And then there's as well the problem that you can't ever be sure that no other plugin will redefine the pluggable function (again) after you redefined it.

  • I don't think the security of a WordPress install should be the responsibility of a user. WordPress is continuously striving to provide a secure and robust platform so users don't have to worry about it. So why should it not worry about making sure plugins can do no harm? Specifically in this case, WordPress has a perfectly fine basic nonce functionality, but still decides to implement this security risk by allowing the functions to be overridden. – Honoki Mar 26 '13 at 13:31
  • Regular users cannot install plugins. Admins can do that, and they know what they do, or the site will be hacked anyway. – fuxia Mar 26 '13 at 13:35
  • When I said 'users', I meant 'admins'. :) Anyway, the risk is always there. People are often the weakest link in security. It seems odd to allow a relaxation of security if it's not at all necessary. Or can somebody show an example of where a custom nonce implementation has been necessary? – Honoki Mar 26 '13 at 13:39
  • 2
    See my update with two examples to improve the nonce security. Admins can change their own site anyway, so the pluggable functions don't hurt. – fuxia Mar 26 '13 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.