New answers tagged


Building on what @lucas-bustamante wrote (which helped me a ton!), once you have the X-WP-Nonce header setup in your custom routes you can do the following: register_rest_route('v1', '/my_post', [ 'methods' => WP_REST_Server::CREATABLE, 'callback' => [$this, 'create_post'], 'args' => [ 'post_title' => [ ...


It looks like one of your plugins/themes is vulnerable and allows anyone to modify your database. For example ThemeGrill themes have such vulnerability lately. Another possibility is that your site got hacked and there's some backdoor placed on it. In both cases you should: check all your site clean it update it secure it.


I've run your code and it works fine to me except for the inclusion in file-access.php: require_once($_SERVER['DOCUMENT_ROOT'].'/wp-load.php'); enable debug to see if there are errors depending on other issues and not regarding these specific code lines. But.. as per WP documentation: actions reference the earlier action hook where the authentication ...


The file that would normally be called to kick off the Wordpress setup is wp-blog-header.php so maybe try swapping out wp-load.php for wp-blog-header.php in your code then re-test


Any subscriber can't do any harm to your site even if he wants it.


Worth having a read of the trac bug here: In short, you can use stripslashes as onetrickpony already mentioned, or wp_unslash, to remove the slashes from your $_POST vars.


You have two way to proceed: 1) Use the .htaccess file to exclude the folder from begin listed 2) Exclude the json files from crawlers scan by adding them inside the robots.txt file.


With the user-name-based nonces, i think you are trying to protect yourself from CSRF attacks, this should work to some extent (hard to tell without the full source code), that being said the nonces should be assigned to a specific action (not only an action), so, for example, you do not assign it to a "delete item" action but rather to "delete item with ID=...

Top 50 recent answers are included