Yes, and yes, RIPS is an excellent tool to do both.
You can use it to check the quality of your WordPress themes and plugins or any other WordPress theme and plugin.
RIPS is a static code analysis tool to automatically detect vulnerabilities in PHP applications. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by user input (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities RIPS also offers an integrated code audit framework for further manual analysis.
Here is how it works simplified.
File Manipulation
This usage would not be smart and RIPS will detect the possible flows
$h = fopen( $_GET['file'], 'w' );
fwrite( $h, $_GET['data'] );
You must not trust data from the requests.
File Disclosure
When you write code like this RIPS will point you this is the wrong style:
echo file_get_contents( 'files/' . $_GET['file'] );
You must not trust data from the requests.
Similar for the include:
include( 'includes/' . $_GET['file'] );
Cross-Site Scripting
RIPS understand possible XSS flows your WordPress theme or plugin may have and will warn you for this.
echo ( 'Hello ' . $_GET['name'] );
And when someone creates the request like this:
/url?name=<script>alert(1)</script>
You need to encode request data since you cannot trust it if raw in this case.
Response splitting
header( 'Location: ' . $_GET['url'] );
Since PHP allows you to use header() you cannot trust the request since someone may add Set-Cookie: or similar inside. RIPS will help you check this.
Fixed sessions
Like explained in OWASP one may force session via setcookie()
setcookie( 'PHPSESSID', $_GET['sessid'] );
like in here
/url?sessid=1f3870be274f6c49b3e31a0c6728957f'
Good thing RIPS can understand that and will update you.
Code injection
eval( '\$color = \' . $_GET['color'] . '\';' );
You should not trust the request data.
'poc' => '/index.php?color=\';phpinfo();//',
or one modification of it called reflection injection
call_user_func( $_GET['func'] );
like in here:
/url?func=phpinfo'
Similar for exec()
exec( './crypto -mode ' . $_GET['mode'] );
RIPS will let you know for these possible problems.
SQL injection
Anyone heard for WordPress security heard for SQL injection concept.
mysql_query( 'SELECT * FROM users WHERE id = ' . $_GET['id'] );
If we add
/url?id=1 OR 1=1-- -',
RIPS will help you feel like the old security geek in here.
There are more security checks RIPS can do for you I haven’t mentioned in here.
Download it and start checking your WordPress themes and plugins.