Fix plugin check plugin errors to improve overall codebase.

iamdharmesh · iamdharmesh · commit 49c93d564e8a · 2026-01-08T16:28:42.000+05:30
diff --git a/includes/admin/admin-notices.php b/includes/admin/admin-notices.php
@@ -7,6 +7,11 @@
 
 namespace Mailchimp\WordPress\Includes\Admin;
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * Display success admin notice.
  *
diff --git a/includes/admin/class-mailchimp-user-sync.php b/includes/admin/class-mailchimp-user-sync.php
@@ -325,7 +325,8 @@ public function subscriber_status_field() {
 					_n(
 						'You will need %1$sa Mailchimp plan%2$s that includes %3$d contact.',
 						'You will need %1$sa Mailchimp plan%2$s that includes %3$d contacts.',
-						absint( $users_count )
+						absint( $users_count ),
+						'mailchimp'
 					),
 					'<a href="https://mailchimp.com/help/about-mailchimp-pricing-plans/" target="_blank" rel="noopener noreferrer">',
 					'</a>',
diff --git a/includes/admin/templates/activate-account.php b/includes/admin/templates/activate-account.php
@@ -5,6 +5,10 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
 ?>
 <div class="mailchimp-sf-confirm-email-wrapper mailchimp-sf-content-box-wrapper <?php echo esc_attr( ( ! $signup_initiated ) ? 'hidden' : '' ); ?>">
 	<div class="mailchimp-sf-confirm-email mailchimp-sf-content-box">
diff --git a/includes/admin/templates/create-account-page.php b/includes/admin/templates/create-account-page.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 $admin_email = get_option( 'admin_email' );
 $user        = get_user_by( 'email', $admin_email );
 
diff --git a/includes/admin/templates/header.php b/includes/admin/templates/header.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 $user         = get_option( 'mc_user' );
 $is_logged_in = ! ( ! $user || ( ! get_option( 'mc_api_key' ) && ! mailchimp_sf_get_access_token() ) );
 ?>
@@ -68,4 +73,4 @@
 			</div>
 		<?php endif; ?>
 	</div>
-</div>
+</div>
diff --git a/includes/admin/templates/login-button.php b/includes/admin/templates/login-button.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 $button_text = $login_button_text ?? __( 'Log in', 'mailchimp' );
 ?>
 <button id="mailchimp_sf_oauth_connect" class="button mailchimp-sf-button button-primary">
diff --git a/includes/admin/templates/login.php b/includes/admin/templates/login.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 ?>
 <div class="wrap">
 	<hr class="wp-header-end" style="display:none;"/>
diff --git a/includes/admin/templates/settings-header.php b/includes/admin/templates/settings-header.php
@@ -5,6 +5,10 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
 ?>
 <div class="mailchimp-sf-settings-page-hero-wrapper">
 	<div class="mailchimp-sf-settings-page-hero">
diff --git a/includes/admin/templates/settings.php b/includes/admin/templates/settings.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 use function Mailchimp\WordPress\Includes\Admin\admin_notice_error;
 
 $user         = get_option( 'mc_user' );
@@ -94,6 +99,7 @@ function ( $ele ) {
 									</div>
 									<div class="mailchimp-sf-settings-list-select-button">
 										<input type="hidden" name="mcsf_action" value="update_mc_list_id" />
+										<?php wp_nonce_field( 'update_mc_list_id_action', 'update_mc_list_id_nonce' ); ?>
 										<input type="submit" name="submit" value="<?php esc_attr_e( 'Fetch list settings', 'mailchimp' ); ?>" class="mailchimp-sf-button btn-secondary" />
 									</div>
 								</div>
diff --git a/includes/admin/templates/setup-page.php b/includes/admin/templates/setup-page.php
@@ -5,6 +5,10 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
 ?>
 <div class="mailchimp-sf-main-setings-wrapper">
 	<div class="mailchimp-sf-main-settings">
@@ -224,7 +228,7 @@
 							<tr>
 								<th class="mailchimp-sf-option-header">
 									<label for="mc_nuke_all_styles">
-										<?php esc_html_e( 'Remove CSS' ); ?>
+										<?php esc_html_e( 'Remove CSS', 'mailchimp' ); ?>
 									</label>
 								</th>
 								<td>
@@ -234,7 +238,7 @@
 											<input type="checkbox" name="mc_nuke_all_styles" id="mc_nuke_all_styles" class="mailchimp-sf-checkbox" <?php checked( get_option( 'mc_nuke_all_styles' ), true ); ?> onclick="showMe('mc-custom-styling')"/>
 										</div>
 										<label for="mc_nuke_all_styles">
-											<?php esc_html_e( 'This will disable all Mailchimp CSS, so it\'s recommended for WordPress experts only.' ); ?>
+											<?php esc_html_e( 'This will disable all Mailchimp CSS, so it\'s recommended for WordPress experts only.', 'mailchimp' ); ?>
 										</label>
 									</div>
 								</td>
@@ -265,7 +269,7 @@
 											<input type="checkbox" name="mc_custom_style" id="mc_custom_style" class="mailchimp-sf-checkbox"<?php checked( get_option( 'mc_custom_style' ), 'on' ); ?> />
 										</div>
 										<label for="mc_custom_style">
-											<?php esc_html_e( 'Edit the default Mailchimp CSS style.' ); ?>
+											<?php esc_html_e( 'Edit the default Mailchimp CSS style.', 'mailchimp' ); ?>
 										</label>
 									</div>
 								</td>
diff --git a/includes/admin/templates/suggest-to-login.php b/includes/admin/templates/suggest-to-login.php
@@ -5,6 +5,10 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
 ?>
 <div class="mailchimp-sf-suggest-to-login mailchimp-sf-content-box-wrapper hidden">
 	<div class="mailchimp-sf-content-box">
diff --git a/includes/admin/templates/user-sync.php b/includes/admin/templates/user-sync.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 global $wp_settings_sections, $wp_settings_fields;
 ?>
 <div class="mailchimp-sf-user-sync-page-wrapper">
diff --git a/includes/blocks/mailchimp-form-field/field-markup.php b/includes/blocks/mailchimp-form-field/field-markup.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 $list_id                 = $block->context['mailchimp/list_id'] ?? '';
 $show_required_indicator = $block->context['mailchimp/show_required_indicator'] ?? true;
 $template                = $block->context['mailchimp/template'] ?? 'default';
diff --git a/includes/blocks/mailchimp-form-group/markup.php b/includes/blocks/mailchimp-form-group/markup.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 $list_id    = $block->context['mailchimp/list_id'] ?? '';
 $group_id   = $attributes['id'] ?? '';
 $label      = $attributes['label'] ?? '';
diff --git a/includes/blocks/mailchimp/markup.php b/includes/blocks/mailchimp/markup.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 // Check if we should display the form.
 if ( ! mailchimp_sf_should_display_form() ) {
 	return;
diff --git a/includes/class-mailchimp-form-submission.php b/includes/class-mailchimp-form-submission.php
@@ -99,6 +99,7 @@ public function handle_form_submission() {
 		$merge_fields          = get_option( 'mc_merge_vars', array() );
 		$interest_groups       = get_option( 'mc_interest_groups', array() );
 
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce check is already done in the request_handler() function.
 		// Check if request from latest block.
 		if ( isset( $_POST['mailchimp_sf_list_id'] ) ) {
 			$list_id               = isset( $_POST['mailchimp_sf_list_id'] ) ? sanitize_text_field( wp_unslash( $_POST['mailchimp_sf_list_id'] ) ) : '';
@@ -148,6 +149,7 @@ public function handle_form_submission() {
 		} else {
 			$email_type = 'html';
 		}
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
 
 		$response = $this->subscribe_to_list(
 			$list_id,
@@ -251,10 +253,11 @@ public function prepare_merge_fields_body( $merge_fields, $skip_merge_validation
 			$opt = 'mc_mv_' . $tag;
 
 			// Skip if the field is not required and not submitted.
-			if ( ( true !== (bool) $merge_field['required'] && ! isset( $_POST[ $opt ] ) ) || $skip_merge_validation ) {
+			if ( ( true !== (bool) $merge_field['required'] && ! isset( $_POST[ $opt ] ) ) || $skip_merge_validation ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce check is already done in the request_handler() function.
 				continue;
 			}
 
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce check is already done in the request_handler() function.
 			$opt_val = isset( $_POST[ $opt ] ) ? map_deep( stripslashes_deep( $_POST[ $opt ] ), 'sanitize_text_field' ) : '';
 
 			switch ( $merge_field['type'] ) {
@@ -339,6 +342,7 @@ public function prepare_groups_body( $interest_groups ) {
 
 		foreach ( $interest_groups as $interest_group ) {
 			$ig_id = $interest_group['id'];
+			// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce check is already done in the request_handler() function.
 			if ( isset( $_POST['group'][ $ig_id ] ) && 'hidden' !== $interest_group['type'] ) {
 				switch ( $interest_group['type'] ) {
 					case 'dropdown':
@@ -367,6 +371,7 @@ public function prepare_groups_body( $interest_groups ) {
 						break;
 				}
 			}
+			// phpcs:enable WordPress.Security.NonceVerification.Missing
 		}
 		return $groups;
 	}
@@ -544,6 +549,7 @@ public function remove_empty_merge_fields( $merge ) {
 	 * @return bool|WP_Error True if valid, WP_Error if invalid.
 	 */
 	protected function validate_form_submission() {
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce check is already done in the request_handler() function.
 		$spam_message = esc_html__( "We couldn't process your submission as it was flagged as potential spam. Please try again.", 'mailchimp' );
 		// Make sure the honeypot field is set, but not filled (if it is, then it's a spam).
 		if ( ! isset( $_POST['mailchimp_sf_alt_email'] ) || ! empty( $_POST['mailchimp_sf_alt_email'] ) ) {
@@ -579,5 +585,6 @@ protected function validate_form_submission() {
 		 * @param array $post_data The $_POST data.
 		 */
 		return apply_filters( 'mailchimp_sf_form_submission_validation', true, $_POST );
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
 	}
 }
diff --git a/mailchimp.php b/mailchimp.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Plugin Name:       Mailchimp
+ * Plugin Name:       Mailchimp List Subscribe Form
  * Plugin URI:        https://mailchimp.com/help/connect-or-disconnect-list-subscribe-for-wordpress/
  * Description:       Add a Mailchimp signup form block, widget or shortcode to your WordPress site.
  * Text Domain:       mailchimp
@@ -34,6 +34,11 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 // Check if the autoload file exists
 if ( is_readable( __DIR__ . '/vendor/autoload.php' ) ) {
 	require_once __DIR__ . '/vendor/autoload.php';
@@ -421,7 +426,7 @@ function mailchimp_sf_set_form_defaults( $list_name = '' ) {
  * @return void
  **/
 function mailchimp_sf_save_general_form_settings() {
-
+	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce check is already done in the mailchimp_sf_request_handler() function.
 	/*Enable double optin toggle*/
 	if ( isset( $_POST['mc_double_optin'] ) ) {
 		update_option( 'mc_double_optin', true );
@@ -447,11 +452,11 @@ function mailchimp_sf_save_general_form_settings() {
 	/* Update existing */
 	if ( isset( $_POST['mc_update_existing'] ) ) {
 		update_option( 'mc_update_existing', true );
-		$msg = esc_html__( 'Update existing subscribers turned On!' );
+		$msg = esc_html__( 'Update existing subscribers turned On!', 'mailchimp' );
 		admin_notice_success( $msg );
 	} elseif ( get_option( 'mc_update_existing' ) !== false ) {
 		update_option( 'mc_update_existing', false );
-		$msg = esc_html__( 'Update existing subscribers turned Off!' );
+		$msg = esc_html__( 'Update existing subscribers turned Off!', 'mailchimp' );
 		admin_notice_success( $msg );
 	}
 
@@ -521,6 +526,7 @@ function mailchimp_sf_save_general_form_settings() {
 
 	$msg = esc_html__( 'Successfully Updated your List Subscribe Form Settings!', 'mailchimp' );
 	admin_notice_success( $msg );
+	// phpcs:enable WordPress.Security.NonceVerification.Missing
 }
 
 /**
@@ -531,15 +537,20 @@ function mailchimp_sf_change_list_if_necessary() {
 		return;
 	}
 
+	if (
+		! current_user_can( MCSF_CAP_THRESHOLD ) ||
+		! isset( $_POST['update_mc_list_id_nonce'] ) ||
+		! wp_verify_nonce( sanitize_key( $_POST['update_mc_list_id_nonce'] ), 'update_mc_list_id_action' )
+	) {
+		wp_die( 'Security check failed.' );
+	}
+
 	if ( empty( $_POST['mc_list_id'] ) ) {
 		$msg = esc_html__( 'Please choose a valid list', 'mailchimp' );
 		admin_notice_error( $msg );
 		return;
 	}
 
-	// Simple permission check before going through all this
-	if ( ! current_user_can( MCSF_CAP_THRESHOLD ) ) { return; }
-
 	$api = mailchimp_sf_get_api();
 	if ( ! $api ) { return; }
 
@@ -605,7 +616,7 @@ function mailchimp_sf_change_list_if_necessary() {
 				__( '<b>Success!</b> Loaded and saved the info for %d Merge Variables', 'mailchimp' ) . $igs_text,
 				count( $mv )
 			) . ' ' .
-			esc_html__( 'from your list' ) . ' "' . $list_name . '"<br/><br/>' .
+			esc_html__( 'from your list', 'mailchimp' ) . ' "' . $list_name . '"<br/><br/>' .
 			esc_html__( 'Now you should either Turn On the Mailchimp Widget or change your options below, then turn it on.', 'mailchimp' );
 
 			admin_notice_success( $msg );
diff --git a/mailchimp_compat.php b/mailchimp_compat.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /* Form Display Functions */
 if ( ! function_exists( 'mc_display_widget' ) ) {
 
diff --git a/mailchimp_upgrade.php b/mailchimp_upgrade.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * Check plugin version.
  *
diff --git a/mailchimp_widget.php b/mailchimp_widget.php
@@ -5,6 +5,11 @@
  * @package Mailchimp
  */
 
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
 /**
  * Displays a Mailchimp Signup Form
  *
diff --git a/readme.txt b/readme.txt
