WordPress-specific Dictionary
WordPress nonce
Definition
A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.
Also called: nonce, wpnonce, wp_nonce
Why it matters for WordPress
Core and well-built plugins attach nonces to admin forms and AJAX calls so a random third-party page cannot easily forge those actions while you are logged in. A missing or unchecked nonce shows up in CVE write-ups constantly. A nonce is not encryption, and it is not a substitute for capability checks.
How it shows up in practice
- Hidden
_wpnoncefields on settings forms - URLs with
?_wpnonce=on one-click actions - Advisories that say “missing nonce verification” on a privileged endpoint
- Expired nonce errors after leaving an admin tab open too long
What to do
- Keep WordPress and plugins updated when nonce-related bugs ship.
- In custom code, verify nonces and
current_user_can( ... )together. - Do not treat “the URL is obscure” as protection.
- If you build admin UI, fail closed when the nonce is missing or wrong.
Related terms
Nearby ideas in the dictionary
- CSRF CSRF tricks a logged-in browser into sending a request the user did not mean to send.
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- Privilege escalation Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- WordPress user roles User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.