wp-hook-guard: map every reachable WordPress entry point
A static analyzer that maps every user-reachable WordPress entry point — AJAX, admin-post, REST, init — and flags the ones missing an authorization or nonce check.
Most WordPress plugin vulnerabilities come down to a single pattern: a function an attacker can reach that forgot to check whether the caller is allowed to call it.
wp-hook-guard reads plugin source statically and builds a map of every user-reachable entry point — AJAX actions, admin-post handlers, REST routes, init hooks — then flags the ones with no capability check and no nonce.
What it does
- Enumerates AJAX, admin-post, REST and init entry points directly from source.
- Flags handlers that are missing a capability/authorization check or a nonce.
- Turns “read the whole plugin” into “look at these few suspicious hooks first.”
It does not confirm a vulnerability on its own — it tells you where to look, which on a large plugin is most of the work.