← Academy

Secure Code

This section focuses on secure design and implementation for the same vulnerability classes. The goal is to explain the security objective, appropriate control boundary, WordPress-specific protections, and how to verify that a fix actually closes the issue.

Planned article structure

Security Objective · Unsafe Design · Secure Design · WordPress Controls · Secure Code Example · Validation and Encoding · Authorization · Fail-Closed Behavior · Testing the Fix · Checklist · References

IntroductionSecurity boundaries, defense in depth, least privilege, and fail-closed design.

Arbitrary File DeletionConstrain paths, authorize destructive actions, and allowlist valid targets.

Arbitrary File ReadCanonicalize paths, isolate storage, and enforce object-level authorization.

Arbitrary File UploadValidate type, content, destination, permissions, and execution boundaries.

Broken Access ControlVerify capabilities, ownership, tenant boundaries, and permitted state transitions.

Content InjectionAuthorize content mutation and encode output for its final context.

Cross-Site Request Forgery (CSRF)Use nonces correctly while preserving independent authorization checks.

Cross-Site Scripting (XSS)Apply context-aware output encoding and safe HTML handling.

Local File Inclusion (LFI)Remove dynamic include paths or map identifiers to trusted resources.

Open RedirectRestrict destinations to trusted hosts or validated local paths.

PHP Object InjectionAvoid unsafe deserialization and reduce reachable gadget surfaces.

Privilege EscalationProtect role changes, capability assignment, and account-management workflows.

Race ConditionUse atomic operations, locking, uniqueness constraints, and idempotency.

Remote Code Execution (RCE)Eliminate command and interpreter injection paths and unsafe dynamic execution.

Sensitive Data ExposureClassify data, minimize output, authorize access, and prevent cache leakage.

Server-Side Request Forgery (SSRF)Allowlist destinations, resolve safely, and block internal address ranges.

SQL Injection (SQLi)Use prepared statements and avoid dynamic query structure from user input.

Type JugglingUse strict comparisons, explicit parsing, and type-safe validation.