I know this question is ancient, but no, it’s not very secure.
Anyone with knowledge of the AJAX endpoint would be able to generate valid nonces, which defeats the purpose in the first place.
That being said, nonces are a low level defence in the first place: they only stop the simplest of attacks. A clever attacker would have crawled your homepage to begin with, and gobbled up all the nonces (which has a default lifespan of 24 hours these days), and then just use that nonce for the attack. Your AJAX endpoint simply makes that task slightly easier.
EDIT
As Janh pointed out, as long as nonces are user specific, meaning a nonce will only work for a specific user, if so, an ajax generated nonce should be fine. You will probably need to send a bit more information via the AJAX endpoint though, so the returned nonce is tied to the correct user.
Related Posts:
- Should wordpress nonce be placed in html form or in javascript file
- Is it safe to assume that a nonce may be validated more than once?
- Multiple ajax nonce requests
- Nonces, AJAX, script variables & security in WordPress
- How do I check if AJAX nonces are implemented correctly?
- WP Admin AJAX Security – using POST to include a relative URL
- ajax nonce verification failing
- Cache plugins and ajax nonce verification
- Why does check_ajax_referer give a 403 error on https websites?
- Using nonce when loading posts with AJAX
- Ajax Security regarding user priviliges and nonces
- How to stop a nonce from being cached in an inline script, or alternatives to regenerate it if expired?
- nonce_user_logged_out to assign guests unique nonces breaks ajax calls
- jQuery’s .on() method combined with the submit event
- How to get a unique nonce for each Ajax request?
- WordPress Ajax Data Security
- Nonces can be reused multiple times? Bug / Security issue?
- Is wp_nonce_field vulnerable if you know the action name?
- How to HTML5 FormData Ajax
- admin-ajax.php doesn’t work when using POST data and Axios
- Contact Form 7 Custom Post Action
- Custom Form with Ajax
- ajax – why multiple calls to wp_create_nonce() return same value?
- Using Nonces for AJAX that only retrieves data
- AJAX vs Fragment Caching for W3 Total Cache [closed]
- How to verify nonce from Bulk/Quick Edit in save_post?
- How to link WordPress heartbeat to ajax form
- How to add WordPress nonces to ajax request
- Ajax form submission from admin panel
- Security – Ajax and Nonce use [closed]
- Nonces and Ajax request to REST API and verification
- Ajax function returns -1
- Serving nonces through AJAX is not refreshing nonce, returning 403 error
- wp_verify_nonce always returns false when logged in as admin
- Confused on AJAX submit form through page template
- ajax and nonce when JavaScript is in a seperate file
- how to use reCaptcha v3 in wordpress custom login form?
- When is it useful to use wp_verify_nonce
- wp_verify_nonce doesn’t return true on server when it matches the nonce
- Nonce actions and names available via open source
- AJAX requests broken due to HTTPS for wp-admin
- Why does WordPress Heartbeat login not refresh the nonces?
- Prevent page reload after ajax form submission
- wp-admin AJAX with Fetch API is done without user
- submitting form via admin-ajax.php returns 0
- Admin Ajax and HTML5 Formdata
- How to check an ajax nonce in PHP
- Can a wp_nonce created from domain 1 to be verified on domain 2?
- jQuery Ajax passing empty parameters to my function?
- Is it safe to manually sign a user in using AJAX?
- Using ajax with wordpress
- Using AJAX with Forms
- how to send Ajax request in wordpress backend
- Identical wp_rest nonce returned from rest_api
- wp_create_nonce() in REST API makes user->ID zero
- Ajax image upload with media_handle_upload and form.js
- wp_create_nonce function doesn’t work inside a plugin?
- Caching-Plugins and Ajax-Page-Parts
- SSO autologin WordPress + Ajax
- Ajax post returning full html page as response
- Should I check for privileges before hooking into `wp_ajax_$handle` or after?
- Sending variable from ajax on form submit
- contact form ajax empty response error message
- Cache wp-json/posts without a plugin?
- Nonce fails on ajax save
- Can’t trigger an AJAX function with a submit button in the dashboard
- Dynamically add more fields/remove last field in a form
- Ajaxify Form That Submits To Same Page To Display Post Data [closed]
- Is it secure to use admin-ajax.php in front?
- Unable to successfully verify nonce
- Nonce doesn’t validate in nopriv call
- Should I use wp_nonce_field on my contact form?
- Using admin-ajax prevents regular php form submission
- Specify ABSPATH in jQuery url
- WordPress is creating nonce as a logged in user but verifying it incorrectly
- ajax form is returning the dreaded “[HTTP/1.1 400 Bad Request” and a zero
- javascript ajax and nonce
- How to check nonce lifetime value of plugins?
- Output multi-steps form results in same page
- Using get_theme_mod in php ajax form doesn’t work
- How to create a form button that executes a function?
- How to stop being directed to admin.php after sending request to admin-ajax.php
- 200 return code on ‘POST /wp-admin/admin-ajax.php’ while NOT logged in
- Custom RPC end-point security best pratice?
- How to display contact form 7 form in vanilla js without jquery in frontend
- Prevent AJAX caching from plugin
- Add Server Side validation in Ajax mail form
- How to send automatic response after form submission without plugin
- How to prevent my external API call from being called by anyone but me (my site)
- Opening Modal popup on Ajax form submission
- WordPress wp_localize_script nonce and ajax URL
- Why are the most recent posts not appearing in a fetch request, unless I’m logged in?
- WordPress REST API FormData: Form Not Submitted When No Files Attached
- How to make Contact Form 7 work when injected via AJAX in WordPress?
- How do i set up ajax nonce
- admin-ajax.php won’t load without logging as admin- JSON Parse error: Unexpected EOF
- How does the security of admin_ajax.php work?
- Catch Form value at AJAX Form submit
- Nonce verification problem when logging in after a logout
- Is there a solution to expired nonces in forms when using full page caching that doesn’t involve configuring the cache?