I know that this is not the only tutorial that has code that check nonce for meta boxes but this is truly idiotic. Nonce should be checked per the whole action not per parts of it and if your save_post hook was called it means that the save nonce was already checked and found valid, so There is no need for more security checks.
My advice is to simply remove anything related to nonce from your metabox code, but if you will feel better having it around just change the code to
// verify nonce
if ( !isset($_POST[ 'my_meta_box_nonce' ]) || !wp_verify_nonce( $_POST[ 'my_meta_box_nonce' ], basename( __FILE__ ) ) )
return $post_id;
which will bail out when no nonce was supplied or the nonce failed validation
Related Posts:
- How does nonce verification work?
- How to expire a nonce?
- Fatal error: Call to undefined function wp_create_nonce()
- How to add/retrieve the post trash link?
- Using nonce external of WP Admin
- Nonce best practices: hidden input vs. wp_localize_script?
- “The link you followed has expired” when previewing a post
- wp_verify_nonce keeps failing
- Handling nonce generation in AJAX registration process
- increase nonce lifespan
- wp_verify_nonce() via REST always returns false
- Nonce failing in IE
- my theme breaks WP export
- Why am I getting a 403 from check_admin_referer()?
- x-wp-nonce across domains
- wp_create_nonce doesn’t verify when using WP_List_Table
- Handling expired nonces
- What is really “wp_nonce_field” and how does it work? [duplicate]
- Cannot verify nonce
- wp_verify_nonce return false despite correct parameter passed
- WordPress JSON API nonces and Vue development server
- Verify a nonce in Form submission
- phpcs error in WordPress
- Stop WordPress nonces expiring
- Several nonces?
- Nonce for Trashing Item
- Nonce keeps failing
- Public posts – preventing duplicate form submissions
- How to obtain “wp_rest” nonce for WP Statistics plugin manually?
- WordPress “nonce” message
- CSP nonces with Cloudflare Workers
- Why are nonces working in Firefox but not in Chrome?
- wp_verfy_nonce keeps giving false
- Nonce – reissue with ajax poll
- wp_nonce_url generating invalid links
- How to insert wp_nonce field within echoed string
- Weird nonce validation problem
- Logout button in menu without “wp” in links
- Check nonce in the new bulk_edit_posts action
- nonce de sécurité invalide
- wp_verify_nonce vs check_admin_referer
- Do I need a nonce field for every meta box I add to my custom post type admin?
- Can I use the same nonce for multiple requests on the same page?
- How to get a unique nonce for each Ajax request?
- Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script
- Are Nonces Useless?
- How to use nonce with front end submission form?
- Extend WordPress (4.x) session and nonce
- Nonces can be reused multiple times? Bug / Security issue?
- How do WordPress Nonces Work?
- Nonces and Cache
- How do I create a user using the new JSON api in 4.7?
- AJAX nonce with check_ajax_referer()
- Verify nonce in REST API?
- Is wp_nonce_field vulnerable if you know the action name?
- Using nonce in menu item
- Is it safe to assume that a nonce may be validated more than once?
- Multiple ajax nonce requests
- What is nonce and how to use it with Ajax in WordPress? [duplicate]
- Do I require the use of nonce?
- Getting “The link you followed has expired” when adding custom post [closed]
- Should nonce be sanitized?
- Nonce in settings API with tabbed navigation
- Using Nonces for AJAX that only retrieves data
- WordPress REST API call generates nonce twice on every call
- WordPress “Link has expired” error on updating posts
- How to verify nonce from Bulk/Quick Edit in save_post?
- Handling nonces for actions from guests to logged-in users
- How to add WordPress nonces to ajax request
- Can I verify nonce which was generated on a different WP site?
- WordPress failure when logging out
- Reduce nonce lifespan
- Security – Ajax and Nonce use [closed]
- Headless WordPress: How to authenticate front end requests?
- Nonces and Ajax request to REST API and verification
- How to stop _wpnonce and _wp_http_referer from appearing in URL
- Ajax function returns -1
- Undefined index: at_nonce in custom post metabox
- Serving nonces through AJAX is not refreshing nonce, returning 403 error
- “Notice: Undefined index:” error when adding new content?
- WP REST API: check if user is logged in
- Custom Meta Boxes – Nonce Issue – Move to trash issue
- Security around save_post hook
- wp_verify_nonce always returns false when logged in as admin
- how to get nonce using json api
- ajax and nonce when JavaScript is in a seperate file
- Confusion on WP Nonce usage in my Plugin
- Properly applying nonce to a form using AJAX
- When is it useful to use wp_verify_nonce
- WordPress password reset – why post rp_key?
- wp_verify_nonce doesn’t return true on server when it matches the nonce
- How to save multiple metaboxes?
- Can’t GET draft posts via REST API from headless frontend
- Rest API invalid nonce with Backbone Client
- Nonce actions and names available via open source
- AJAX requests broken due to HTTPS for wp-admin
- Nonces, AJAX, script variables & security in WordPress
- Full page NGINX (or Cloudflare) caching and WordPress nonces
- Why does WordPress Heartbeat login not refresh the nonces?
- How to get the wpnonce value?