Among the functions in /wp-includes/pluggable.php
are the functions wp_verify_nonce
and wp_create_nonce
. Both functions are very important in the protection against CSRF-attacks. However, it is easy to override these functions in a plugin so that all nonces are accepted as valid.
if( ! function_exists('wp_verify_nonce') ) {
function wp_verify_nonce($nonce, $action = -1) {
return 1;
}
}
I have tested this, and indeed, CSRF protection is now disabled site-wide.
What's the reason that these functions are put in the pluggable.php
file if the security risks are so obvious?