WP Manifestindependent plugin directory
manifest / ai / wapuubot

Wapuubot WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Adds an LLM chatbot agent to the WordPress admin area, capable of writing posts, maintaining tags/categories, and more!

★ 1stars
10release downloads
≈10active sites
0.2blatest · 8mo ago

Install

Download wapuubot.zip From the 0.2b release on GitHub, Feb 17, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mattpearce/wapuubot/releases/download/0.2b/wapuubot.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A smart, AI-powered assistant integrated directly into your WordPress Admin.

Wapuubot lives in your dashboard as a friendly chat bubble. It uses the WordPress AI Client and the Abilities API to help you manage your site through natural language conversation. Whether you need to draft a post, organize categories, or tag content, Wapuubot can do it for you.

✨ Features

  • 💬 Interactive Chat Interface: A floating chat bubble in the admin area that opens a persistent chat window.
  • 🧠 Context Aware: Knows which post you are currently editing and provides relevant suggestions.
  • 📝 Post Management:
    • Create new drafts.
    • Edit existing posts (titles, content, status).
    • Search for posts by title.
    • Retrieve post content for analysis.
  • 🏷️ Taxonomy Management:
    • Create, list, and delete categories.
    • Assign categories to posts.
    • Add tags to posts automatically.
  • 🔌 Extensible: Built on the Abilities API, allowing it to discover and use new tools registered by other plugins.
  • 💾 Persistent History: Chat history is saved locally, so you can navigate between pages without losing context.

📸 Screenshots

Chat Interface Post Management
Chat Interface Post Management
Wapuubot in Action Context Aware Actions
Tagging & Categories
Tagging More Features
Intelligent Tagging Advanced Capabilities

🚀 Installation

Requirements

  • WordPress 6.4+
  • PHP 7.4+
  • An API Key for an AI Provider (OpenAI, Anthropic, etc.)

Setup

  1. Clone this repository into your wp-content/plugins/ directory:
    git clone https://github.com/yourusername/wapuubot.git
    cd wapuubot
  2. Install dependencies via Composer (required to load AI Client and Abilities API):
    composer install --no-dev
  3. Activate the Wapuubot plugin in WordPress.
  4. Navigate to Settings > AI Credentials in your WordPress Admin.
  5. Enter your API Key (e.g., OpenAI Key) and save.

💡 Usage

  1. Click the Wapuu Bubble in the bottom-right corner of your admin screen.
  2. Type a command! Examples:
    • "Create a post about the history of jazz."
    • "What tags should I add to this post?" (When editing a post)
    • "Create a new category called 'Music' and assign this post to it."
    • "Delete the 'Uncategorized' category."
  3. Wapuubot will execute the actions and confirm when done.

🤝 Contributing

We welcome contributions!

  1. Fork the repository.
  2. Create a branch for your feature (git checkout -b feature/amazing-feature).
  3. Commit your changes (git commit -m 'Add amazing feature').
  4. Push to the branch (git push origin feature/amazing-feature).
  5. Open a Pull Request.

Development

  • Linting: We use phpcs with WordPress Coding Standards. Run composer run lint (if configured) or use phpcs directly to check your code.
  • Structure:
    • wapuubot.php: Main plugin file and chat handler.
    • abilities/: Contains ability registrations and callbacks.
    • assets/: CSS and JS files.

📄 License

GPLv2 or later.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.2b latest
Feb 17, 2026 8mo ago
wapuubot.zip
4
Feb 16, 2026 8mo ago
wapuubot.zip
6

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Wapuubot 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.0
Findings
2
Worst severity
medium
Content hash
b42dd7f50428714253045001…

Findings

  • medium Telegram webhook accepts unauthenticated forged updates without secret token

    missing_auth

    REST route wapuubot/v1/telegram-webhook uses permission_callback __return_true and never verifies Telegram's secret_token / X-Telegram-Bot-Api-Secret-Token. Anyone who discovers the URL can POST forged Update JSON. If allowed users option is empty, is_user_allowed() returns true for everyone; pairing mode auto-appends attackers to the allowlist. Forged messages are then processed as bot commands against WordPress abilities.

    includes/class-wapuubot-telegram.php:35-80

  • low Public debug-abilities REST endpoint discloses registered abilities

    information_disclosure

    GET /wapuubot/v1/debug-abilities is registered with __return_true and returns name/label/description for every wp_get_abilities() entry, aiding reconnaissance of available automation surfaces.

    wapuubot.php:90-110

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.