New answers tagged

2

Yes, nonces should always be used when an authenticated user is triggering an action via a GET/POST request. One of the main purposes of the nonce is it ensure that the current user actually intended to trigger this request. It prevents the security vulnerability known as Cross-Site Request Forgery (CSRF), where an attacker can trick an authenticated user ...


0

One way this stuff can be exposed without CLI access is if the php module in apache is absent or broken for whatever reason it just dumps the raw php. I've not tested this recently, this was a few years ago. But it is not cool. Technically since Wordpress is open source you can just do something like this: define('DB_PASSWORD', '`cat /etc/wp_db_pass | ...


1

There's possibly a slight disconnect between your question title and the actual question. It sounds like you're using a plugin (or developing a plugin?) that allows for some front end sorting. If it's a plugin you're using and the query string parameter is not sanitized, you need to notify that plugin's developer. Fixing it yourself might solve the ...


Top 50 recent answers are included