WordPress MCP Ability Suite WP Registry grade B-. Medium-severity findings · 5 findingsWP RegistryMedium-severity findings · 5 findingsOpen the reportB-

Medium-severity findings.

Audited release

1.2.0

Findings

5

Worst severity

medium

Content hash

bc662cc571ba86dad541f0b4… Copy

Findings

• medium Subscriber-reachable read tools return password-protected and non-public published objects by ID

  information_disclosure

  Any logged-in user can mint their own API key (wp-mcp/v1/api-keys, is_user_logged_in) and call read abilities gated only on current_user_can('read'). get-post-raw-content and get-post-block-structure resolve the post through wp_mcp_get_post_or_error(), which only refuses non-'publish' posts the user cannot read_post. It does not check post_password or whether the post type is publicly viewable. A Subscriber can therefore enumerate IDs and read the raw and rendered content of password-protected posts and pages, and of 'publish'-status objects in non-public post types: synced patterns (wp_block), templates and navigation, and third-party CPTs that store data with publish status (e.g. Flamingo inbound messages holding contact-form PII). Rendered content also executes the_content shortcodes in the Subscriber's context.

  includes/helpers.php:36-49

  Recommendation

  Require current_user_can( 'read_post', $id ) unconditionally. Also refuse post_password_required() posts and post types where is_post_type_viewable() is false, unless the user can edit_post.

• medium API key and token scopes are stored and advertised but never enforced

  missing_capability

  API keys default to scopes ['read'], the token endpoint copies a caller-supplied 'scope', and JWT carries 'scopes', but no code path consults them. check_permission() just calls wp_set_current_user($auth_result['user_id']), and each ability checks only WordPress capabilities. A key an administrator creates as 'read' for a third-party AI/SaaS therefore grants their full write and delete authority: publish-post, delete-post force, update-post-meta, create-term. Leaked or over-shared 'read-only' credentials have full account impact.

  includes/saas-auth/class-saas-auth-provider.php:196-218

  Recommendation

  Enforce scopes, e.g. a filter on ability permission callbacks that denies non-readonly abilities unless the token or key has 'write', and admin-level ones unless it has 'admin'. Alternatively, remove the scope UI so it does not imply a restriction.

• low get-reusable-blocks exposes draft and published synced patterns to Subscribers

  information_disclosure

  The get-reusable-blocks ability is gated on 'read' and returns post_content of up to 200 wp_block posts in publish and draft status, from all authors. Core restricts wp_block reading to edit_posts. Impact is usually limited to design snippets.

  includes/abilities/tools.php:532-560

  Recommendation

  Gate on edit_posts and filter results by read_post.

• low create-draft-post accepts any post type with only edit_posts

  missing_capability

  create-draft-post checks current_user_can('edit_posts'), then calls wp_insert_post with a caller-chosen post_type (any registered type: page, wp_template, wp_navigation, custom types) and arbitrary unprotected meta. It ignores the type's own create_posts/edit_posts capability. The result is only a draft and kses still applies, so impact is limited to creating unauthorized draft objects.

  includes/abilities/tools.php:653-706

  Recommendation

  Check get_post_type_object( $post_type )->cap->create_posts and restrict to show_in_rest post types.

• low WP_DEBUG-gated unauthenticated auth-test route and credential-fragment logging

  debug_code

  With WP_DEBUG on, wp-mcp/v1/auth/test (permission_callback __return_true) echoes detailed authentication results for any supplied credentials. validate_access_token() and other paths also error_log token prefixes, stored hash prefixes and Authorization-header fragments. debug.log is commonly web-readable.

  includes/saas-auth/class-saas-auth-provider.php:739-750

  Recommendation

  Remove the debug route or require manage_options. Do not log any token or hash material.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.