Be Watchful: PHP And WordPress Functions That Can Make Your Site Insecure

For validating a URL, WordPress’s function will have a similar impact, but only lets through allowed protocols. is not in the default list, so it would keep you safe. However, unlike filter_var, it’ll return an empty string (not a false) for a disallowed protocol that is passed to it. WordPress-specific Functions To Keep An Eye On
In addition to core-PHP potentially-vulnerable functions, there are some WordPress-specific functions that can be a bit of a gotcha. Some of these are very similar to the variety of dangerous functions listed above, some a little different.
WordPress Unserializes With maybe_unserialize
This one’s probably obvious if you read the above. In WordPress there’s a function called maybe_unserialize and, as you’d guess, it unserializes what’s passed to it if need be.
There’s not any new vulnerability that this introduces, the issue is simply that just like the core unserialize function, this one can cause a vulnerable object to be exploited when it’s unserialized.
is_admin Doesn’t Answer If A User Is An Administrator!
This one’s pretty simple, but the function is ambiguous in name, and so it’s prone
Source: https://managewp.org/articles/17007/be-watchful-php-and-wordpress-functions-that-can-make-your-site-insecure

source https://williechiu40.wordpress.com/2018/01/29/be-watchful-php-and-wordpress-functions-that-can-make-your-site-insecure/