x.comthreadFrancis Santerre (@santerref) on X
Post announcing that the MCP Adapter (0.7.0) is now a canonical plugin on WordPress.org, bridging the WordPress Abilities API to MCP. It exposes a default server at /wp-json/mcp/mcp-adapter-default-server, and only abilities a site marks public are exposed. The author's point is that the security review reduces to auditing the list of public abilities, which gives reviewers and pentesters a new endpoint to enumerate.
TL;DR WordPress MCP Adapter 0.7.0 adds a default MCP endpoint at /wp-json/mcp/mcp-adapter-default-server; audit which abilities are marked public.
Also seen from another angle🧠 AI →
Organisations named here
- Abilities API
- MCP Adapter
- /wp-json/mcp/mcp-adapter-default-server
Technologies named here
- WordPress MCP Adapter plugin 0.7.0
- WordPress Abilities API
- WordPress
- Model Context Protocol
Techniques named here
- Attack surface review
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup