WordPress Quality Control & Assurance 4

Question 1

Which database table prefix check is part of a WordPress security QA audit?

Accepted Answer

Verifying the prefix has been changed from the default 'wp_'

Answer

Changing the default 'wp_' table prefix reduces the risk of SQL injection attacks that target predictable table names.

Question 2

When validating custom post type registration quality, which argument prevents the post type from appearing in search results?

Accepted Answer

'exclude_from_search' => true

Answer

Setting 'exclude_from_search' to true removes a public post type's posts from WordPress front-end search results.

Question 3

A QA engineer notices that a plugin enqueues scripts on every page, including admin pages where they are not needed. What is the correct fix?

Accepted Answer

Wrap wp_enqueue_script() with an is_admin() check (or its inverse)

Answer

Checking is_admin() (or ! is_admin()) before enqueuing ensures scripts only load on the intended front-end or admin context.

Question 4

Which WordPress function should QA verify is used instead of a direct database query for retrieving posts?

Accepted Answer

WP_Query

Answer

WP_Query is the proper WordPress API for retrieving posts, providing caching, hooks, and security compared to raw queries.

Question 5

During a plugin QA review, you find unserialize() called on user input. Why is this a critical security issue?

Accepted Answer

It can trigger PHP object injection attacks

Answer

Unserializing untrusted user input can lead to PHP object injection, allowing attackers to execute arbitrary code.

WordPress Practice Test