WordPress AI Connector WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

0.4.2

Findings

4

Worst severity

high

Content hash

cd464c8d831530f82165075d… Copy

Findings

• high MCP update/delete post tools lack per-object capability and post-type checks (Contributor can modify or delete any content)

  missing_capability

  wp_update_post is gated only by the primitive 'edit_posts' and wp_delete_post only by 'delete_posts' (dispatch_tool_call -> current_user_can($capability)). The handlers accept any ID, verify only that get_post($id) exists (any post type: posts, pages, attachments, products, wp_template, wp_navigation, etc.), and call wp_update_post()/wp_delete_post() directly without current_user_can('edit_post'/'delete_post', $id). A Contributor can therefore permanently delete any content (force=true), overwrite other users' published posts, unpublish pages, or publish their own posts without review. Authentication is easy: a logged-in cookie on the root /mcp path (no REST nonce), an Application Password, or a self-authorized OAuth token.

  includes/tools/class-posts-tool.php:63-98, 153-189

  Recommendation

  In every per-object tool, check current_user_can('edit_post', $id) / current_user_can('delete_post', $id) and enforce post_type === 'post'. When the target status is publish, also check publish_posts.

• medium wp_get_post / wp_list_posts disclose other users' private, draft and password-protected posts

  information_disclosure

  wp_list_posts runs WP_Query with post_status from input (default 'any') and no 'perm' => 'readable', and wp_get_post returns raw post_content for any post ID of type 'post' without current_user_can('read_post', $id). Any edit_posts user (Contributor) can enumerate and read other authors' private posts, drafts, pending posts and password-protected content.

  includes/tools/class-posts-tool.php:101-126

  Recommendation

  Add 'perm' => 'readable' to the query and filter results with current_user_can('read_post'/'edit_post', $id). Check the same before returning content in wp_get_post.

• medium Unauthenticated, unbounded OAuth dynamic client registration writes to an option without limit

  dos

  POST /oauth/register (and /wp-json/wp-ai-connector/v1/oauth/register) has permission_callback __return_true. Each call appends a new client record to the wpaic_oauth_clients option with no rate limit, count cap or expiry. grant_types, response_types and scope are stored unsanitized, and redirect_uris can be arbitrarily long arrays. An anonymous attacker can grow this option to many megabytes, and it is loaded and rewritten in full on every registration, authorize and token request, which degrades or breaks the OAuth flow and stresses the database.

  includes/oauth/class-oauth-store.php:25-60

  Recommendation

  Store clients in a dedicated table or as per-client options. Cap the number and size of DCR registrations, rate-limit by IP, sanitize every field, and expire clients that never complete authorization.

• low Request log (on by default) persists plaintext OAuth secrets from token requests

  information_disclosure

  WPAIC_Request_Log is enabled unless WPAIC_DEBUG_REQUESTS is false, and the root router logs the first 500 bytes of every /oauth/token request body. Those bodies contain authorization codes, PKCE code_verifier, refresh_token and client_secret values. They are stored in plaintext in the wpaic_request_log option, which defeats the hashed-at-rest storage of refresh tokens and client secrets, and are rendered on the admin page. Anyone with database or backup access can replay refresh tokens.

  includes/class-root-router.php:75-99

  Recommendation

  Turn request logging off by default and redact sensitive form/JSON fields (code, code_verifier, refresh_token, client_secret, token) before persisting.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.