There is no security risk in a pluggable function: If someone installs a plugin that lowers the security it is his/her own fault. On the other hand, you can override the functions to make nonces more unique or to change their format.
In a custom function wp_verify_nonce() you could use an optional third parameter or change the time a nonce expires.
Nowadays pluggable functions aren’t introduced anymore. They are hard to debug, and you can do the same with filters usually. And then there’s as well the problem that you can’t ever be sure that no other plugin will redefine the pluggable function (again) after you redefined it.
Related Posts:
- Best collection of code for your 'functions.php' file [closed]
- What security concerns should I have when setting FS_METHOD to “direct” in wp-config?
- What Are Security Best Practices for WordPress Plugins and Themes? [closed]
- Disable email notification after change of password
- Are WordPress Plugins essential?
- I found this in a plugin. What does it do? is it dangerous?
- What are the common security flaws I need to look for? [closed]
- Disabled plugins are they security holes – rumor or reality?
- How do I call wp_get_current_user() in a plugin when plugins are loaded before pluggable.php?
- What could a hacker do with my wp-config.php
- How Can I Securely Implement a Password-less Login Feature?
- Security and .htaccess
- Why “Contact Form 7” doesn’t update PHPmailer library?
- Are there procedures to prevent malicious plugin updates?
- Secure WordPress paid plugin
- How to make media upload private? [duplicate]
- Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
- What does a security risk in a plugin look like?
- why plugins are loaded prior to pluggables
- WordPress Capabilities: edit_user vs edit_users
- Should we use plugins that aren’t available from the official WordPress site?
- How to check plugins for malicious code?
- How to properly secure my WordPress installation?
- Editor access to plugin settings
- Where should my plugin POST to?
- Security error WP 4.0 + WP phpBB Bridge [closed]
- Should I install plugins to my WordPress installation from web sites having in URL “nulled” or, “null”?
- Disabled plugins are security holes – rumor or reality?
- Why am I sometimes getting a 404 error when I try to update a page with Elementor?
- Should I use RIPS tool to test my themes and plugins?
- Prevent Brute Force Attack
- Why users disable the WordPress update?
- How many security plugins are too many? [closed]
- Will WordPress username displayed somewhere in the site?
- Upgrading WordPress 4.0 asks for FTP password
- Overriding a function in wordpress
- Is revealing just the AUTH_KEY a security issue?
- How Restrict access to admin dashboard by specific static ip?
- When is it useful to use wp_verify_nonce
- Protecting against malicious code in WordPress plugin updates
- Questions about brute force attacks on the admin username, coming from amazon IP addresses
- Why Better WP security plugin returns 418 I’m a Teapot “error”?
- How to expire all wordpress user passwords instantly?
- How to limit WordPress pages during updates?
- rms_unique_wp_mu_pl_fl_nm.php
- Current user in plugin returns NULL
- Weird problems after recovery from security breach
- How can we deal with unmaintained plugins with vulnerabilities?
- Security issues with WP sites
- Security checking in meta_box save is reluctant?
- Escape when echoed
- Should you escape hardcoded URLs?
- Preventing BFA in WordPress without using a plugin
- Best way to modify a plugin with no hooks and no pluggable functions?
- How can I make uploaded images in the editor load with HTTPS?
- How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- Call to undefined function get_userdata in user.php
- WordPress filter that hook after each action/filter hook
- WordPress Registration Email by Role
- How to delete Passwrd Protected posts cookies when a user logged out from the site
- The safest way to automate WordPress backups
- wp_create_nonce function doesn’t work inside a plugin?
- Overriding functions in wordpress plugins
- Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)
- Upgraded to latest version – 3.0.3 and Now I get a “sufficient permissions to access this page” error
- Headers Content-Security-Policy CSP Major Issue
- How to block plugin activations with no known user or coming from unknown IP address range?
- Nonce failing on form submission
- Check for security updates
- Standard Fail2Ban vs. WP Fail2ban vs. WP Fail2Ban Redux
- Why can’t I access my Intranet LDAPS with NADI?
- Malicious File Upload [closed]
- Stop Plugin Enumeration [closed]
- Malware installation during plugin update?
- Hack-Proof OR Security in WordPress — is it real?
- I should enable automatic updates?
- Can some vulnerabilities in plugins be exploited even when the plugin is inactive?
- Security and Must Use Plugins
- Is Timthumb still broken? What security measures should be taken?
- Prevent direct access to WordPress plugin assets?
- Is it safe to use admin-ajax.php in the frontend?
- How to protect WordPress from security scanner [closed]
- remove_action not removing add_action from constructor
- How to execute init or woocommerce_init only for checkout page
- How to resolve these findings from security audit
- How I can hide my wp folders from Inspect Element (Developer Tools)
- How to Find WordPress site has backdoor login Codes
- How to delete Password Protected posts cookies when a user logged out from the site
- How to rename files during upload to a random string?
- Stop the user if login from the cookies
- WordPress User Registration/ Sign Up -> Able to take Paid Certification Courses & keep track of Completed Certificates
- Block Root REST API Route using custom &/or iThemes
- Is it a good idea to restrict the REST API
- WordPress.Security.NonceVerification.Recommended
- Secure way to add JS Script to WordPress filesystem
- Bullet proofing a server with 150 WP insallations
- Code Snippets security when selecting “only run on front end”
- What is the best way to override functions of thirdparty plugins?
- How to verify/test that a custom built wordpress theme is as secure as possible?