wordpress-plugin-core

SKILL.md

Secure WordPress plugin development with hooks, database interactions, Settings API, custom post types, and REST API.

Covers three architecture patterns (Simple, OOP, PSR-4) plus the Security Trinity (sanitize input, validate logic, escape output) with 29 documented vulnerability prevention patterns

Includes critical security foundations: unique prefixes, ABSPATH checks, nonce verification, prepared statements, and capability checks with real 2025-2026 CVE examples

Addresses WordPress 6.7-6.9 breaking changes: bcrypt password hashing migration, WP_Dependencies deprecation, translation loading timing, and REST API permission callback requirements

Provides patterns for custom post types, taxonomies, meta boxes, Settings API, REST endpoints, and AJAX with performance comparisons (REST API 10x faster than admin-ajax.php)

WordPress Plugin Development (Core)

Last Updated: 2026-01-21
Latest Versions: WordPress 6.9+ (Dec 2, 2025), PHP 8.0+ recommended, PHP 8.5 compatible
Dependencies: None (WordPress 5.9+, PHP 7.4+ minimum)

Quick Start

Architecture Patterns: Simple (functions only, <5 functions) | OOP (medium plugins) | PSR-4 (modern/large, recommended 2025+)