wp_create_nonce doesn’t verify when using WP_List_Table

by

This question still unanswered for long time. I answer it if anyone reaches here, just in case.

When you are using WP_List_Table (perhaps by extending the class), the generated code for single delete and bulk delete differs. The single delete is sent over a GET request by setting query params, but the bulk delete is sent over a POST request by setting form-data. (You can investigate it by checking the network tab of developer tools.)

So, generated nonce also differs in these situations, and IMO it is a bad design by WordPress that both requests call process_bulk_action method. BTW you must check the conditions, like:

if (is_array($_REQUEST['id'])) {
    $true = wp_verify_nonce($_REQUEST['_wpnonce'], 'bulk-' . $this->_args['plural']);
} else if (is_string($_REQUEST['id'])) {
    $true = wp_verify_nonce($_REQUEST['_wpnonce'], 'sp_delete_genre');
}

You could also check the request method, but I guess $_REQUEST['id'] is more reliable.

P.S. WordPress official website notices that extending WP_List_Table is not safe enough!

Note: This class’s access is marked as private. That means it is not intended for use by plugin and theme developers as it is subject to change without warning in any future WordPress release. If you would still like to make use of the class, you should make a copy to use and distribute with your own project, or else use it at your own risk.

P.S. Two resources that I used and I’d like to mention.
https://gist.github.com/petenelson/8981536
https://stackoverflow.com/questions/25000403/verifying-nonce-from-wp-list-table