WordPress Nonces: What They Actually Protect, and What They Do Not
Every few weeks a critical vulnerability lands in a WordPress plugin and the write-up includes the same phrase: "the nonce check passed, but". The latest example is [CVE-2026-1492](/blog/user-registra...