Verify Nonces on All State-Changing Actions

// ❌ Form handler with no CSRF protection
add_action( 'admin_post_save_settings', function() {
    update_option( 'my_plugin_api_key', $_POST['api_key'] );
    wp_redirect( admin_url( 'options-general.php?page=my-plugin' ) );
    exit;
});
 
// ❌ Checking nonce exists but not verifying its value
add_action( 'admin_post_delete_item', function() {
    if ( isset( $_POST['_wpnonce'] ) ) {
        // Still vulnerable! Never verified the nonce value
        wp_delete_post( $_POST['post_id'], true );
    }
});
 
// ❌ Nonce verified but no capability check — any logged-in user can trigger this
add_action( 'admin_post_promote_user', function() {
    check_admin_referer( 'promote_user_nonce' );
    // Missing: current_user_can() check!
    wp_update_user([ 'ID' => $_POST['user_id'], 'role' => 'administrator' ]);
});

// Step 1: Generate nonce in the form
function render_settings_form() {
    ?>
    <form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
        <input type="hidden" name="action" value="save_settings">
        <?php wp_nonce_field( 'my_plugin_save_settings', '_wpnonce' ); ?>
 
        <input type="text" name="api_key"
               value="<?php echo esc_attr( get_option( 'my_plugin_api_key' ) ); ?>">
        <?php submit_button(); ?>
    </form>
    <?php
}
 
// Step 2: Verify nonce + capability in the handler
add_action( 'admin_post_save_settings', function() {
    // Verify nonce — dies automatically on failure
    check_admin_referer( 'my_plugin_save_settings' );
 
    // Verify capability — nonce alone is not authorization
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( 'Unauthorized' );
    }
 
    // Sanitize input
    $api_key = sanitize_text_field( wp_unslash( $_POST['api_key'] ) );
    update_option( 'my_plugin_api_key', $api_key );
 
    wp_safe_redirect( admin_url( 'options-general.php?page=my-plugin&updated=1' ) );
    exit;
});

// ✅ URL-based actions (e.g., "Delete" links in admin tables)
// Generate:
$delete_url = wp_nonce_url(
    admin_url( 'admin-post.php?action=delete_item&id=' . $item_id ),
    'delete_item_' . $item_id
);
 
// Verify:
add_action( 'admin_post_delete_item', function() {
    $item_id = absint( $_GET['id'] );
    check_admin_referer( 'delete_item_' . $item_id );
 
    if ( ! current_user_can( 'delete_posts' ) ) {
        wp_die( 'Unauthorized' );
    }
 
    wp_delete_post( $item_id, true );
    wp_safe_redirect( wp_get_referer() );
    exit;
});

# Find admin_post handlers without nonce checks
grep -rn "admin_post_" wp-content/plugins/ --include="*.php" -l | xargs grep -L "check_admin_referer\|wp_verify_nonce"
# Find POST handlers without nonce verification
grep -rn "\$_POST\[" wp-content/plugins/ --include="*.php" -l | xargs grep -L "nonce\|referer"