URL and form actions

Updated 30 Oct 2026 16 min read

On this page

How dispatch works
Cart actions
Checkout and payment actions
Account actions
Email and receipt actions
Order actions in the admin
Customer actions in the admin
Discount actions in the admin
Report and export actions
Tools, settings and notices
Upgrade actions
Request parameters that are not hooks
Writing your own action
Notes

RestroPress dispatches many of its requests as actions: a request carries an action name, and the plugin fires the WordPress action rpress_{name} with the request data. Each built-in handler is a callback on that hook. You can add your own handler with add_action( 'rpress_my_action', 'my_callback' ) and call it with a link or form.

How dispatch works#

There are two dispatchers, one for each spelling of the parameter.

Dispatcher	Parameter	File	Runs on	Behaviour
Front end	`rpress_action`	`includes/rp-actions.php`	`init`	`rpress_get_actions()` reads `$_GET['rpress_action']` and runs `do_action( "rpress_{$key}", $_GET )`. `rpress_post_actions()` reads `$_POST['rpress_action']` and runs `do_action( "rpress_{$key}", rpress_sanitize_array( $_POST ) )`.
Admin	`rpress-action` (hyphen)	`includes/admin/admin-actions.php`	`admin_init`	`rpress_process_actions()` does nothing unless `is_admin()` and the user is logged in. It reads `$_POST['rpress-action']` and `$_GET['rpress-action']`, passes the name through `sanitize_key()`, and runs `do_action( 'rpress_' . $action, rpress_sanitize_array( $_POST or $_GET ) )`.

The front-end dispatcher runs on init for every request, including visitors and admin-ajax.php, so any rpress_* hook can be fired by anyone who can send a request. A handler must therefore do its own nonce and capability checks. Many built-in handlers do; the tables below say which.
The dispatcher passes the request data as the only argument. Front-end handlers receive $_GET unsanitized for GET requests and a sanitized copy of $_POST for POST requests; admin handlers always receive a sanitized copy. The sanitizing function is rpress_sanitize_array().
Several handlers read $_GET or $_POST directly as well as the argument.
The tables show the dispatcher that core's own links and forms use. A handler fires from whichever dispatcher the request used, so an action written with rpress_action works in the admin too (the front-end dispatcher also runs there).
Most handlers end the request with a redirect and exit. Read the Notes at the end for handlers that behave unexpectedly.

In every table, Hook is the action name to hook, Handler is the core callback, and the method is the one core's links or forms use.

Cart actions#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`add_to_cart`	`rpress_add_to_cart`	`rpress_process_add_to_cart()`	Front (`rpress_action`); GET link or POST form	Adds a menu item to the cart. Reads `fooditem_id`, `rpress_options` (for example `price_id`) and `fooditem_qty`. Redirects to checkout when "straight to checkout" is on, otherwise back to the page without the action arguments. No nonce.	includes/cart/actions.php:83
`remove`	`rpress_remove`	`rpress_process_remove_from_cart()`	Front (`rpress_action`); GET	Removes the cart line given by `cart_item`, then redirects back. No nonce.	includes/cart/actions.php:96
`remove_fee`	`rpress_remove_fee`	`rpress_process_remove_fee_from_cart()`	Front (`rpress_action`); GET	Removes the fee named by `fee`, then redirects back. No nonce.	includes/cart/actions.php:109
`purchase_collection`	`rpress_purchase_collection`	`rpress_process_collection_purchase()`	Front (`rpress_action`); GET	Adds every menu item of a taxonomy term to the cart. Reads `taxonomy` and `terms`; redirects with `added=1`.	includes/cart/actions.php:124
`update_cart`	`rpress_update_cart`	`rpress_process_cart_update()`	Front (`rpress_action`); POST (cart form)	Sets the quantity of each line from `rpress-cart-fooditems` and the per-line quantity and options fields. No redirect; the page renders again.	includes/cart/actions.php:137
`save_cart`	`rpress_save_cart`	`rpress_process_cart_save()`	Front (`rpress_action`); GET link	Saves the cart for later. Redirects to checkout only if saving fails.	includes/cart/actions.php:150
`restore_cart`	`rpress_restore_cart`	`rpress_process_cart_restore()`	Front (`rpress_action`); GET link	Restores the saved cart and redirects to checkout on success.	includes/cart/actions.php:163

Checkout and payment actions#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`purchase`	`rpress_purchase`	`rpress_process_purchase_form()`	Front (`rpress_action`); POST (checkout form)	Validates the checkout form, creates the order and sends the customer to the payment gateway. Requires the nonce `rpress_checkout_nonce` (field `security` or `rpress_checkout_nonce`), a non-empty cart, an enabled service type, an open store and a service time. The same function also answers the `rpress_process_checkout` AJAX action.	includes/process-purchase.php:237
`straight_to_gateway`	`rpress_straight_to_gateway`	`rpress_process_straight_to_gateway()`	Front (`rpress_action`); GET or POST	Builds an order for one menu item and goes directly to its gateway. Reads `fooditem_id`, `rpress_options`, `rpress_fooditem_quantity`. If the gateway is not enabled it adds the item to the cart and redirects to checkout. No nonce.	includes/process-purchase.php:1223
`gateway_select`	`rpress_gateway_select`	`rpress_process_gateway_select()`	Front (`rpress_action`); POST (gateway form)	When `gateway_submit` is present, redirects back with `payment-mode` set from the posted value.	includes/gateways/actions.php:25
`recover_payment`	`rpress_recover_payment`	`rpress_recover_payment()`	Front (`rpress_action`); GET (link in a recovery email)	Resumes an unpaid order. Needs `payment_id` and the matching `payment_key` (compared with `hash_equals`), a recoverable order, and the same user (or a guest order for a logged-out visitor). Empties the cart, re-adds the order lines, fees and discounts, and redirects to checkout with the order's gateway.	includes/payments/actions.php:486
`remove_cart_discount`	`rpress_remove_cart_discount`	`rpress_remove_cart_discount()`	Front (`rpress_action`); GET link	Removes the discount in `discount_code` (requires `discount_id` as well) and redirects to checkout. No nonce.	includes/discount-functions.php:892

Account actions#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`user_login`	`rpress_user_login`	`rpress_process_login_form()`	Front (`rpress_action`); POST (login form)	Logs a user in from `rpress_user_login` (username or email) and `rpress_user_pass`, honoring `rememberme`, then redirects to `rpress_redirect`. Requires nonce `rpress-login-nonce` in `rpress_login_nonce`; on a bad nonce nothing happens.	includes/login-register.php:87
`user_register`	`rpress_user_register`	`rpress_process_register_form()`	Front (`rpress_action`); POST (registration form)	Validates username, email and password, creates the user with the site's default role, logs them in and redirects. Needs `rpress_register_submit`. Skipped for logged-in users. No nonce.	includes/login-register.php:161
`edit_user_profile`	`rpress_edit_user_profile`	`rpress_process_profile_editor_updates()`	Front (`rpress_action`); POST (profile editor)	Saves name, email, address and an optional new password for the logged-in user and updates the customer record. Nonce `rpress-profile-editor-nonce` in `rpress_profile_editor_nonce`.	includes/shortcodes.php:110
`profile-remove-email`	`rpress_profile-remove-email`	`rpress_process_profile_editor_remove_email()`	Front (`rpress_action`); GET link	Removes the address in `email` from the logged-in customer's record and redirects to `redirect`. Nonce `rpress-remove-customer-email` in `_wpnonce`.	includes/shortcodes.php:151
`send_verification_email`	`rpress_send_verification_email`	`rpress_process_user_verification_request()`	Front (`rpress_action`); GET link	Sends the account verification email to the logged-in user whose account is still pending, then redirects. Dies with 403 if not logged in or already verified.	includes/user-functions.php:808
`verify_user`	`rpress_verify_user`	`rpress_process_user_account_verification()`	Front (`rpress_action`); GET (link in the verification email)	Checks `token`, `user_id` and `ttl` against the signed URL and marks the user verified. Invalid tokens end with a 403 page.	includes/user-functions.php:842

Email and receipt actions#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`view_receipt`	`rpress_view_receipt`	`rpress_render_receipt_in_browser()`	Front (`rpress_action`); GET	Renders the receipt page for `payment_key` as a stand-alone page and exits. Dies if the key is missing.	includes/emails/template.php:308
`send_test_email`	`rpress_send_test_email`	`rpress_send_test_email()`	Front (`rpress_action`); GET link	Builds the test purchase receipt email. Nonce `rpress-test-email` in `_wpnonce`; then redirects without the action.	includes/emails/actions.php:83
`email_links`	`rpress_email_links`	`rpress_resend_purchase_receipt()`	Admin (`rpress-action`); GET link	Resends the receipt for `purchase_id`. Requires `edit_shop_payments`. No nonce. Redirects with `rpress-message=email_sent`.	includes/emails/actions.php:66

Order actions in the admin#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`update_payment_details`	`rpress_update_payment_details`	`rpress_update_payment_details()`	Front (`rpress_action`); POST (order edit form)	Saves the order edit screen: service type, date and time, status, order status, customer, address, items, totals and notes. Uses `check_admin_referer( 'rpress_update_payment_details_nonce' )` and `edit_shop_payments`.	includes/admin/payments/actions.php:288
`delete_payment`	`rpress_delete_payment`	`rpress_trigger_purchase_delete()`	Admin (`rpress-action`); GET link	Deletes an order and redirects to the order list. Needs nonce `rpress_payment_nonce` in `_wpnonce` and `delete_shop_payments`. Reads `purchase_id`.	includes/admin/payments/actions.php:307
`trash_order`	`rpress_trash_order`	`rpress_trigger_trash_order()`	Admin (`rpress-action`); GET link	Moves an order to the trash. Same nonce and capability. Reads `purchase_id`.	includes/admin/payments/actions.php:329
`restore_order`	`rpress_restore_order`	`rpress_trigger_restore_order()`	Admin (`rpress-action`); GET link	Restores a trashed order. Same nonce and capability.	includes/admin/payments/actions.php:343
`delete_order`	`rpress_delete_order`	`rpress_trigger_destroy_order()`	Admin (`rpress-action`); GET link	Deletes an order permanently. Same nonce and capability.	includes/admin/payments/actions.php:366
`delete_payment_note`	`rpress_delete_payment_note`	`rpress_trigger_payment_note_deletion()`	Admin (`rpress-action`); GET link	Deletes the order note `note_id` of `payment_id`. Nonce `rpress_delete_payment_note_{note_id}`; capability `edit_shop_payments`; redirects to the order.	includes/admin/payments/actions.php:416
`upgrade_payments`	`rpress_upgrade_payments`	`rpress_update_old_payments_with_totals()`	Front (`rpress_action`); GET	One-time routine that stores totals on orders from before version 1.2. Needs nonce `rpress_upgrade_payments_nonce`; runs once (option `rpress_payment_totals_upgraded`). Core renders no link to it.	includes/payments/actions.php:291

Customer actions in the admin#

Every customer handler needs is_admin() to be true (an admin page or admin-ajax.php) and the capability from the rpress_edit_customers_role filter, default edit_shop_payments (note saving uses rpress_view_customers_role, default view_shop_reports). They send the form or link nonce shown below.

Action value	Hook	Handler	Front or admin; method	What it does	Source
`edit-customer`	`rpress_edit-customer`	`rpress_edit_customer()`	Front (`rpress_action`); POST (edit form)	Updates a customer's name, email, linked user and address from `customerinfo`. Nonce `edit-customer`. Answers with JSON.	includes/admin/customers/customer-actions.php:135
`customer-add-email`	`rpress_customer-add-email`	`rpress_add_customer_email()`	Front (`rpress_action`); POST (admin JS)	Adds an email to a customer from `email`, `customer_id`, `primary`. Nonce `rpress-add-customer-email`. Answers with JSON `success`, `message`, `redirect`.	includes/admin/customers/customer-actions.php:212
`customer-remove-email`	`rpress_customer-remove-email`	`rpress_remove_customer_email()`	Front (`rpress_action`); GET link	Removes the address in `email` from customer `id`. Nonce `rpress-remove-customer-email`. Redirects.	includes/admin/customers/customer-actions.php:254
`customer-primary-email`	`rpress_customer-primary-email`	`rpress_set_customer_primary_email()`	Front (`rpress_action`); GET link	Makes the address in `email` primary for customer `id`. Nonce `rpress-set-customer-primary-email`. Redirects.	includes/admin/customers/customer-actions.php:297
`add-customer-note`	`rpress_add-customer-note`	`rpress_customer_save_note()`	Front (`rpress_action`); POST (note form)	Adds a note to a customer record. Nonce `add-customer-note`.	includes/admin/customers/customer-actions.php:347
`delete-customer`	`rpress_delete-customer`	`rpress_customer_delete()`	Front (`rpress_action`); GET link	Moves a customer to the trash. Nonce `delete-customer`. Redirects.	includes/admin/customers/customer-actions.php:488
`restore-customer`	`rpress_restore-customer`	`rpress_customer_restore()`	Front (`rpress_action`); GET link	Restores a trashed customer. Nonce `restore-customer`.	includes/admin/customers/customer-actions.php:519
`delete-customer-permanently`	`rpress_delete-customer-permanently`	`rpress_customer_delete_permanently()`	Front (`rpress_action`); GET link	Deletes a customer permanently. Nonce `delete-customer-permanently`.	includes/admin/customers/customer-actions.php:559
`disconnect-userid`	`rpress_disconnect-userid`	`rpress_disconnect_customer_user_id()`	Front (`rpress_action`); POST (admin JS)	Detaches the WordPress user from a customer. Nonce `edit-customer`. Answers with JSON.	includes/admin/customers/customer-actions.php:700
`verify_user_admin`	`rpress_verify_user_admin`	`rpress_process_admin_user_verification()`	Front (`rpress_action`); GET link	Marks the linked user verified. Reads `id`. Nonce `rpress-verify-user`.	includes/admin/customers/customer-actions.php:729

Discount actions in the admin#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`add_discount`	`rpress_add_discount`	`rpress_add_discount()`	Admin (`rpress-action`); POST (add form)	Creates a discount code from `name`, `code`, `type`, `amount` and the other form fields. Nonce `rpress_discount_nonce` in `rpress-discount-nonce`; capability `manage_shop_discounts`; redirects to `rpress-redirect`.	includes/admin/discounts/discount-actions.php:82
`edit_discount`	`rpress_edit_discount`	`rpress_edit_discount()`	Admin (`rpress-action`); POST (edit form)	Saves changes to `discount-id`. Same nonce and capability.	includes/admin/discounts/discount-actions.php:135
`delete_discount`	`rpress_delete_discount`	`rpress_delete_discount()`	Admin (`rpress-action`); GET link	Deletes the discount in `discount`. Nonce `rpress_discount_nonce` in `_wpnonce`; capability `manage_shop_discounts`.	includes/admin/discounts/discount-actions.php:155
`activate_discount`	`rpress_activate_discount`	`rpress_activate_discount()`	Admin (`rpress-action`); GET link	Activates `discount`. Same checks.	includes/admin/discounts/discount-actions.php:176
`deactivate_discount`	`rpress_deactivate_discount`	`rpress_deactivate_discount()`	Admin (`rpress-action`); GET link	Deactivates `discount`. Same checks.	includes/admin/discounts/discount-actions.php:197

Report and export actions#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`filter_reports`	`rpress_filter_reports`	`rpress_parse_report_dates()`	Front (`rpress_action`); report filter form	Converts the submitted date range into query arguments and redirects to the reports page with `view`, `fooditem-id` and `exclude_taxes`. No checks; it only redirects.	includes/admin/reporting/graphing.php:876
`refresh_reports_transients`	`rpress_refresh_reports_transients`	`rpress_run_refresh_reports_transients()`	Front (`rpress_action`); GET link	Deletes the cached report statistics. Nonce `rpress-refresh-reports` in `_wpnonce`. No capability check.	includes/admin/reporting/graphing.php:912
`fooditem_batch_export`	`rpress_fooditem_batch_export`	`rpress_process_batch_export_fooditem()`	Front (`rpress_action`); GET (link produced by the AJAX export)	Downloads the finished batch export named by `class`. Nonce `rpress-batch-export` in `nonce`; the class must extend `RPRESS_Batch_Export` and the user needs `export_shop_reports`.	includes/admin/reporting/export/export-actions.php:32
`email_export`	`rpress_email_export`	`rpress_export_all_customers()`	Front (`rpress_action`); form submit	Downloads the customers CSV. The export class checks `export_shop_reports`; the handler checks no nonce. Registered in two files.	includes/admin/reporting/export/export-actions.php:47
`fooditems_history_export`	`rpress_fooditems_history_export`	`rpress_export_all_fooditems_history()`	Front (`rpress_action`); form submit	Downloads the menu items CSV. Same checks. Registered in two files.	includes/admin/reporting/export/export-actions.php:59
`earnings_export`	`rpress_earnings_export`	`rpress_export_earnings()`	Front (`rpress_action`); form submit	Downloads the earnings CSV. The export class checks `export_shop_reports`.	includes/admin/export-functions.php:27
`payment_export`	`rpress_payment_export`	`rpress_export_payment_history()`	Front (`rpress_action`); form submit	Downloads the order history CSV. Same check.	includes/admin/export-functions.php:40

Tools, settings and notices#

Action value	Hook	Handler	Front or admin; method	What it does	Source
`export_settings`	`rpress_export_settings`	`rpress_tools_import_export_process_export()`	Front (`rpress_action`); POST	Sends the RestroPress settings and tax rates as a JSON download. Nonce `rpress_export_nonce`; capability `manage_shop_settings`. A second handler, `rpress_process_settings_export()`, is hooked in `includes/admin/import-export.php:99`.	includes/admin/tools.php:890
`import_settings`	`rpress_import_settings`	`rpress_tools_import_export_process_import()`	Front (`rpress_action`); POST (multipart)	Imports settings from an uploaded JSON file and redirects. Nonce `rpress_import_nonce`; capability `manage_shop_settings`. A second handler, `rpress_process_settings_import()`, is hooked in `includes/admin/import-export.php:128`.	includes/admin/tools.php:936
`upload_import_file`	`rpress_upload_import_file`	`rpress_do_ajax_import_file_upload()`	Front (`rpress_action`); POST (multipart)	Receives the CSV for a batch import and answers with JSON (`form`, `class`, `upload`, `first_row`, `columns`, `nonce`). Nonce `rpress_ajax_import` in `rpress_ajax_import`; requires the import class's `can_import()`.	includes/admin/import/import-functions.php:85
`save_enabled_betas`	`rpress_save_enabled_betas`	`rpress_tools_enabled_betas_save()`	Front (`rpress_action`); POST	Saves the beta opt-ins. Nonce `rpress_save_betas_nonce`; capability `manage_shop_settings`.	includes/admin/tools.php:768
`save_banned_emails`	`rpress_save_banned_emails`	`rpress_tools_banned_emails_save()`	Front (`rpress_action`); POST	Saves the blocked email list from `banned_emails`. Nonce `rpress_banned_emails_nonce`; capability `manage_shop_settings`.	includes/admin/tools.php:810
`clear_doing_upgrade`	`rpress_clear_doing_upgrade`	`rpress_tools_clear_upgrade_notice()`	Front (`rpress_action`); POST	Deletes the "upgrade in progress" flag. Nonce `rpress_clear_upgrades_nonce`; capability `manage_shop_settings`.	includes/admin/tools.php:827
`submit_debug_log`	`rpress_submit_debug_log`	`rpress_handle_submit_debug_log()`	Front (`rpress_action`); POST	Downloads or clears the debug log depending on `rpress-debug-log-contents` / `rpress-clear-debug-log`. Capability `manage_shop_settings`; no nonce.	includes/admin/tools.php:1437
`fooditem_sysinfo`	`rpress_fooditem_sysinfo`	`rpress_tools_sysinfo_fooditem()`	Admin (`rpress-action`); POST	Sends the posted `rpress-sysinfo` text as a download. Capability `manage_shop_settings`; no nonce.	includes/admin/tools.php:1862
`dismiss_notices`	`rpress_dismiss_notices`	`RPRESS_Notices::dismiss_notices()`	Front (`rpress_action`); GET link	Stores a per-user flag for the notice in `rpress_notice` and redirects. Nonce `rpress-dismiss-notice`; needs one of `manage_shop_settings`, `edit_pages`, `view_shop_reports`.	includes/admin/class-rpress-notices.php:26
`opt_into_tracking`	`rpress_opt_into_tracking`	`RPRESS_Tracking::check_for_optin()`	Front (`rpress_action`); GET link	Turns on usage tracking and sends a first check-in. Capability `manage_options`; no nonce.	includes/admin/tracking.php:33
`opt_out_of_tracking`	`rpress_opt_out_of_tracking`	`RPRESS_Tracking::check_for_optout()`	Front (`rpress_action`); GET link	Turns usage tracking off and redirects. Capability `manage_options`; no nonce.	includes/admin/tracking.php:34

Upgrade actions#

The upgrade screen advances a stepped routine by redirecting the browser to index.php?rpress_action={name}&step={n}&total={n} until it finishes. Each routine needs manage_shop_settings, checks no nonce, and redirects to the next step or to the upgrade-complete screen. Source: includes/admin/upgrades/upgrade-functions.php.

Action value	Hook	Handler	Front or admin; method	What it does	Source
`upgrade_sequential_payment_numbers`	`rpress_upgrade_sequential_payment_numbers`	`rpress_v20_upgrade_sequential_payment_numbers()`	Front (`rpress_action`); GET	Gives existing orders sequential order numbers in batches; reads `step`, `total`, `custom`.	includes/admin/upgrades/upgrade-functions.php:318
`upgrade_customers_db`	`rpress_upgrade_customers_db`	`rpress_v21_upgrade_customers_db()`	Front (`rpress_action`); GET	Moves customer data from orders into the customers table in batches; reads `step`.	includes/admin/upgrades/upgrade-functions.php:398
`upgrade_payment_taxes`	`rpress_upgrade_payment_taxes`	`rpress_v23_upgrade_payment_taxes()`	Front (`rpress_action`); GET	Adds tax data to existing orders in batches; reads `step`, `total`.	includes/admin/upgrades/upgrade-functions.php:565
`upgrade_customer_payments_association`	`rpress_upgrade_customer_payments_association`	`rpress_v23_upgrade_customer_purchases()`	Front (`rpress_action`); GET	Links orders to customers in batches; reads `step`, `total`.	includes/admin/upgrades/upgrade-functions.php:716
`upgrade_user_api_keys`	`rpress_upgrade_user_api_keys`	`rpress_upgrade_user_api_keys()`	Front (`rpress_action`); GET	Re-keys stored user API key meta; reads `step`, `total`.	includes/admin/upgrades/upgrade-functions.php:781
`remove_refunded_sale_logs`	`rpress_remove_refunded_sale_logs`	`rpress_remove_refunded_sale_logs()`	Front (`rpress_action`); GET	Removes sale logs of refunded orders in batches; reads `step`, `total`.	includes/admin/upgrades/upgrade-functions.php:834

Request parameters that are not hooks#

These look like actions but are not dispatched through do_action( 'rpress_' ... ), so you cannot hook them by that name.

rpress_action=preview_email: handled in rpress_display_email_template_preview() on template_redirect (requires manage_shop_settings). It outputs the sample receipt.
rpress-action=refresh_pending_count: handled directly on admin_init by rpress_trigger_refresh_pending_count() (requires edit_shop_payments and nonce rpress_refresh_pending_count_nonce).
/rpress-add/{id} and /rpress-remove/{key}: rewrite endpoints registered by cart/actions.php. Visiting them adds a menu item to the cart or removes a cart line, then redirects to checkout. No nonce.
rpress_action=process_api_key is registered by the legacy RPRESS_API class, which core 3.4.11 never loads, so the hook is not active.

Writing your own action#

add_action( 'rpress_my_action', 'my_plugin_handle_my_action' );

function my_plugin_handle_my_action( $data ) {
	if ( ! isset( $data['_wpnonce'] ) || ! wp_verify_nonce( $data['_wpnonce'], 'my_plugin_my_action' ) ) {
		wp_die( esc_html__( 'Security check failed.', 'my-plugin' ), '', array( 'response' => 403 ) );
	}
	if ( ! current_user_can( 'manage_shop_settings' ) ) {
		wp_die( esc_html__( 'You do not have permission.', 'my-plugin' ), '', array( 'response' => 403 ) );
	}
	// Do the work here.
	wp_safe_redirect( admin_url( 'admin.php?page=rpress-settings' ) );
	exit;
}

// Link to it from an admin screen.
$url = wp_nonce_url(
	add_query_arg( 'rpress_action', 'my_action', admin_url( 'admin.php' ) ),
	'my_plugin_my_action'
);

Notes#

The front-end dispatcher fires on every request, so a handler without its own nonce and capability checks can be triggered by a visitor. Core's cart actions (remove, remove_fee, save_cart, restore_cart), straight_to_gateway, user_register and the upgrade_* routines change state from a GET (or an unprotected POST) with no nonce.
user_register creates an account with the site's default role without checking the WordPress "anyone can register" setting.
trash_order, restore_order and delete_order build a redirect URL with admin_url( array(...) ) and never use it, so these handlers do not redirect.
remove reads $_GET['cart_item'] instead of the handler argument, so it fails on a POST dispatch.
email_links reads $_GET['email'] and never uses it, and has no nonce.
export_settings, import_settings, email_export and fooditems_history_export each have two handlers registered in different files.

Was this page helpful?