JakubSECURITY / RESEARCH
← All write-ups

wp-hook-guard: map every reachable WordPress entry point

A static analyzer that maps every user-reachable WordPress entry point — AJAX, admin-post, REST, init — and flags the ones missing an authorization or nonce check.

Most WordPress plugin vulnerabilities come down to a single pattern: a function an attacker can reach that forgot to check whether the caller is allowed to call it.

wp-hook-guard reads plugin source statically and builds a map of every user-reachable entry point — AJAX actions, admin-post handlers, REST routes, init hooks — then flags the ones with no capability check and no nonce.

What it does

  • Enumerates AJAX, admin-post, REST and init entry points directly from source.
  • Flags handlers that are missing a capability/authorization check or a nonce.
  • Turns “read the whole plugin” into “look at these few suspicious hooks first.”

It does not confirm a vulnerability on its own — it tells you where to look, which on a large plugin is most of the work.

View wp-hook-guard on GitHub