feat(checker): add advisory check for public export of post content

[faisalahammad]

What?

Closes #1427

Adds a new advisory (warning-level) security check that flags when post content is written to a file or exposed through an alternative public surface without an apparent access-control guard. This covers static exports, Markdown endpoints, feeds, and REST-like routes that can bypass the access controls of the normal front end.

Why?

Plugins that publish post content through alternative public surfaces can leak password-protected content, membership or LMS-restricted content, and post types with no public URL. Because access control from third-party plugins is not statically knowable, this is a warning, not an error. It highlights risky patterns and prompts manual review rather than asserting a vulnerability.

How?

Added PublicContentExportSniff, a PHPCS sniff extending AbstractFunctionParameterSniff. It inspects the content parameter of export functions (file_put_contents, fwrite, fputs) and detects post-content sources: get_the_content(), the_content(), get_the_excerpt(), the_excerpt(), $post->post_content, get_post_field('post_content'), and apply_filters() calls using content filters. It also traces variables back to the assignment that sourced post content.

The warning is suppressed when an access-control guard appears in the same function scope: post_password_required(), current_user_can(), is_post_type_viewable(), or is_user_logged_in().

New files:

• phpcs-sniffs/PluginCheck/Sniffs/Security/PublicContentExportSniff.php
• includes/Checker/Checks/Security/Public_Content_Export_Check.php
• Registration in Default_Check_Repository.php and ruleset.xml, docs row in docs/checks.md

Testing Instructions

1. Checkout this branch.
2. Run the full PHPUnit suite: npm run test-php (uses wp-env).
3. Run the sniff unit tests: composer run-tests.
4. Run PHPCS lint and PHPStan: composer lint and composer phpstan.
5. Open the test fixtures under tests/phpunit/testdata/plugins/test-plugin-public-content-export-*/ to see warning and clean cases.

Result: all tests pass, lint and static analysis are clean. The with-errors fixture produces 6 warnings, all advisory (never errors).

AI Usage Disclosure

• This PR was created without the help of AI tools
• This PR includes AI-assisted code or content

If AI tools were used, please describe how they were used:
Used Claude Code (an AI coding assistant) to help implement the PHPCS sniff, the check wrapper, tests, and fixtures. The implementation was reviewed and adjusted manually, and all quality gates (PHPUnit, PHPCS lint, PHPStan) were run and passed before submission.

Screenshots or screencast

Not applicable, no UI changes.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: faisalahammad <faisalahammad@git.wordpress.org>
Co-authored-by: davidperezgar <davidperez@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.