Context: I'm developing a public plugin for WP. It has a form placed in WP dashboard. Form page is accessible by admins only.

Problem: The from has a ton of validation logic and hence one is duplicated on PHP and JS side. I want to use JS side validation only to simplify code managing. It is not possible to get rid of JS validation (like sending validation AJAX request on "save" button click) as form fields are rendered based on other fields values and JS will fail if validation won't be performed after each input change event.

Possible solution: Create a unique token on form page loading and save it to user session + add <input type="hidden" name="token" value={token}> to the form. Form will also have an <input type="hidden" name="is_valid" value="{1 or 0}">. Backend will perform only HTML tags sanitization. WP also performs SQL injection sanitization under the hood. Form page handling also will be implemented for admins only, other users will be ignored (to prevent fake POST requests).

Why I expect it should work:

Tokens should prevent CSRF attacks. Even if admin is tricked to click "submit" on the fake form that is placed on malicious site and even if origin header is faked - token won't be know by attackers.

And it is obvious that site admin won't try to hack the form manually and won't send fake POST requests with correct token and malicious data.

Why I'm not sure:

It won't be a big problem if code can be viewed by the team of 2 persons (who already have access to all the databases, codebase, server, etc). But as I said the plugin is public. So anyone can see the code.

Conclusion: May you tell me please how suggested solution may be hacked? And is there any other simpler / more secure solution for described problem?