WordPress MCP

Manage WordPress sites via MCP (Model Context Protocol) through AI Engine. Use for creating/editing posts, SEO analysis, analytics, media management, taxonomy operations, social media scheduling, multilingual content (Polylang), and any WordPress admin task. Requires AI Engine plugin (free) with MCP Server enabled. Also use when asked about WordPress site management, content workflows, or WP-related tasks.

This skill appears to be a coherent controller for WordPress sites via AI Engine's MCP, but take these precautions before installing or using it: 1) Treat the Bearer Token as a high‑privilege secret — only use tokens for sites you administrate and avoid storing them in publicly accessible files; prefer short‑lived or scoped tokens if possible and revoke them after use. 2) Limit enabled MCP features on the target site — do not enable Database, Plugins, Themes, or Dynamic REST unless you explicitly need them, because those tools allow writing code and running SQL. 3) Because the package metadata does not declare the needed credential, assume the agent will require you to provide the token in conversation or a local TOOLS.md; avoid pasting tokens into shared chats or documents. 4) Verify the AI Engine plugin installation and inspect which MCP tools are exposed (run tools/list) before asking the agent to make destructive changes. 5) If you need to run sensitive operations (installing plugins, modifying theme files, direct SQL), perform them manually or under strict supervision rather than granting an automated agent broad autonomous privileges. If you want a higher assurance rating, ask the skill author/source for an explicit credential declaration, changelog, and a homepage or repo to verify origin.

Type: OpenClaw Skill Name: wordpress-mcp Version: 3.3.4 This skill bundle is classified as suspicious due to the exposure of highly privileged and dangerous capabilities that could lead to Remote Code Execution (RCE) and SQL Injection (SQLi) if misused or exploited. Specifically, the `references/dev-tools.md` and `references/features.md` files document tools like `wp_theme_put_file`, `wp_plugin_put_file` (allowing arbitrary file write to theme/plugin directories) and `wp_db_query` (allowing direct execution of SQL queries). While these tools are presented as intended for WordPress management and development, their power makes them critical vulnerabilities if the AI agent's input is not rigorously sanitized, enabling an attacker to compromise the target WordPress site. There is no evidence of intentional malicious prompt injection against the agent, unauthorized data exfiltration, or obfuscation within the skill bundle itself.