AI Wrote Your Plugin. Did It Forget Security?

// AI generates this:
if (isset($_POST['action'])) {
    update_option('setting', $_POST['val']);
}

// Should be:
check_ajax_referer('my_nonce', 'nonce');
if (isset($_POST['action'])) {
    update_option('setting',
        sanitize_text_field($_POST['val']));
}

AI generates $_POST processing without check_ajax_referer() or wp_verify_nonce(). Every unprotected form handler is a CSRF vulnerability.

// AI generates this:
register_rest_route('myplugin/v1', '/data', [
    'callback' => 'get_data',
]);

// Should include:
'permission_callback' => function() {
    return current_user_can('manage_options');
},

register_rest_route() without a permission_callback defaults to public access. REST API authorization issues are the #1 exploited WordPress vulnerability class.

// AI generates this:
echo '<p>' . $user_input . '</p>';

// Should be:
echo '<p>' . esc_html($user_input) . '</p>';

// Or for attributes:
echo '<input value="' . esc_attr($val) . '">';

AI outputs echo $variable instead of echo esc_html($variable). Every unescaped output is a potential XSS vector — especially dangerous in admin pages.

// AI generates this:
$api_key = 'sk-proj-abc123xyz';
$db_pass = 'MySecretPassword1!';

// Should be:
$api_key = get_option('myplugin_api_key');
// Stored encrypted, entered by admin

API keys and passwords baked directly into plugin code. WP HealthKit's secret detection engine catches these before they reach version control or the wp.org directory.