feat(privacy): add check for missing wp_privacy_personal_data_erasers registration

[faisalahammad]

Summary

Adds a new static check (Personal_Data_Eraser_Check) that warns plugin authors when their plugin appears to handle personal data — via add_user_meta, update_user_meta, add_comment_meta, update_comment_meta, or direct $wpdb writes — but does not register a callback via the wp_privacy_personal_data_erasers filter.

Since WordPress 4.9.6, the Personal Data Removal tool lets site administrators honor GDPR erasure requests. Plugins storing personal data are expected to hook into this tool.

Fixes #1252

Changes

includes/Checker/Checks/Plugin_Repo/Personal_Data_Eraser_Check.php (new)

Two-step static check: first confirm the plugin has at least one personal-data storage call, then verify whether it registers the wp_privacy_personal_data_erasers filter. A warning is only emitted when step 1 matches and step 2 does not — avoiding false positives for plugins that never touch personal data.

Key constants:

const PERSONAL_DATA_PATTERN       = '/\b(?:add_user_meta|update_user_meta|add_comment_meta|update_comment_meta|\$wpdb\s*->\s*(?:insert|update|replace))\s*\(/';
const ERASER_REGISTRATION_PATTERN = '/add_filter\s*\(\s*[\'"]wp_privacy_personal_data_erasers[\'"]/';

Warning code: missing_personal_data_eraser
Docs link: https://developer.wordpress.org/plugins/privacy/adding-the-personal-data-eraser-to-your-plugin/

includes/Checker/Default_Check_Repository.php

// Added:
'personal_data_eraser' => new Checks\Plugin_Repo\Personal_Data_Eraser_Check(),

Testing

Test 1: Plugin stores user meta, no eraser registered → should warn

1. Activate a plugin that calls update_user_meta() without hooking wp_privacy_personal_data_erasers
2. Run Plugin Check against it (Admin UI or WP-CLI)
3. Result: warning missing_personal_data_eraser is reported ✅

Test 2: Plugin stores user meta and registers an eraser → should pass

1. Activate a plugin that calls update_user_meta() and registers via add_filter( 'wp_privacy_personal_data_erasers', ... )
2. Run Plugin Check against it
3. Result: no missing_personal_data_eraser warning ✅

Test 3: Plugin has no personal data handling → should pass

1. Run Plugin Check against any plugin that does not call user/comment meta functions or $wpdb writes
2. Result: no missing_personal_data_eraser warning ✅

PHPUnit test class: tests/phpunit/tests/Checker/Checks/Personal_Data_Eraser_Check_Tests.php covers all three cases with dedicated test data plugins.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: faisalahammad <faisalahammad@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.