WordPress Security Review Skill

Overview

Systematic security code review for WordPress themes, plugins, and custom code. Core principle: Three-pillar security model: (1) Sanitize input early, (2) Validate authorization (nonces + capabilities), (3) Escape output late. Scan critical issues first (SQL injection in public code, XSS on unescaped output, missing nonces on state-changing operations), then warnings, then info-level improvements. Report with line numbers, severity, CWE references, and BAD/GOOD code pairs.

When to Use

Use when:

• Security audit of WordPress theme or plugin
• Pre-launch security review
• Investigating reported vulnerability
• Reviewing form handlers, AJAX endpoints, or REST API routes
• Analyzing user input processing or output rendering
• Code review for exploitable patterns (XSS, SQL injection, CSRF, auth bypass)