Every release, as shipped.

• Security: undoing a FunnelKit funnel change now requires FunnelKit's own permission to edit funnels, not only the store manager capability, so a user FunnelKit refuses can no longer delete or revert a funnel through rollback.

• Internal: the test suite no longer prints PHP 8.5 deprecations from its own code or thousands of duplicate ability registration notices, so real warnings stand out. No change to the plugin itself.

• Developer tooling: the local test gate now tests every unpinned third-party test plugin against its latest WordPress.org release on each run, rebuilding only what changed, and its summary names the plugin versions each leg ran against.

• Test suite only: the multisite test run covers the latest network permission and theme checks; the plugin itself is unchanged.

• Multisite: a recurring backup scheduled by a sub-site administrator before 0.8.168 no longer runs. Its schedule is disabled with a recorded reason, any backup it had already queued is canceled, and its existing archives are flagged for a network administrator to review.
• Multisite: list-backup-jobs shows a network administrator every schedule disabled this way, on any site of the network, with the reason. Schedules set by a network administrator, and all single-site schedules, are unchanged.

• Security: payment gateway credentials are now masked in database tool results too, including the before-image returned by row updates and deletes. Rollback still restores the exact stored values. Please update.

• Every change is now also tested on a WordPress multisite network before release, so problems that only appear on a network are caught before they ship.

• Fixed: on a multisite network, switch-theme and install-theme with activate now refuse a theme the network administrator has not enabled for the site, matching the WordPress Themes screen.

• The test suite now runs against Elementor 4.3.4, the current Elementor release, with its recorded atomic widget schemas checked against that version.

• Security: on multisite, the database tools now stay inside the current site for anyone who cannot manage the network. A site administrator can no longer read or change network tables, the main site's tables or other sites' tables, and network options are write-protected by default. Please update.
• Security: the query tool no longer lets "1--1" style arithmetic hide a read of the users table, and MariaDB executable comments are refused.

• Security: on a multisite network, whole-database backup, restore and migration tools (trigger-backup, restore-site-backup, the backup job tools, rewrite-site-urls, push-site-archive and receive-site-archive) now require a network administrator. A sub-site administrator could previously back up every site's tables including password hashes, or restore network tables to become a super admin. Single-site installs are unchanged.

• Internal: the changelog now lists each release's changes under the version that shipped them, and uses one label for Pro features. No change to the plugin itself.

• Fixed: on a multisite network, sub-sites now get WP MCP's own tables (undo history, redirects, search index) on network activation, when a new site is created, and on the next admin or REST request, so undoable writes work on every site.

• New (paid tier): Amelia employees and events. Agents can now create and change Amelia employees with their working hours, breaks and days off, create, change, open or cancel events, and add event attendees, refused when the event has too few places left. No new tools: the operations sit on the existing plugin-data pair.
• Amelia categories, services, employees and customers can be deleted with confirmation, and only while nothing uses them; appointments and events are cancelled, never deleted. Amelia Lite's one-employee limit is refused by name. Customer emails stay held unless the agent asks to notify, and every change can be undone with rollback-operation.

• Security: agent memory entries can no longer be published, edited, created, copied, deleted or rolled back through the generic content, meta, staging, rollback or database row tools, even on an administrator connection. Entries are proposed with the memory tools and go live only when an administrator approves them in wp-admin.
• The generic content tools no longer list or read agent memory entries; use memory-recall instead.

• Security: BuddyPress pending and banned group members are now listed only to the group's admins and to site moderators, matching BuddyPress, not to group mods.
• Fix: listing a BuddyPress group's pending members now includes current membership requests (BuddyPress 5.0 and later).

• New: translate a page in a few calls on Polylang and WPML sites (paid tier). Agents can list the posts still missing a translation into a language, create a linked draft translation (content, builder data, meta, template and featured image copied, categories and tags mapped to their translations), read all of a page's translatable text as numbered segments, and write the translations back as one change.
• Page text covers the title, excerpt, SEO title and description, Elementor widget text and block or classic content. Writes are checked against a content hash, refused as a whole if any segment is unknown, never change the source page, and can be rolled back.

• Security: payment gateway credentials (API keys, webhook secrets, tokens) are now masked when gateway settings are read through get-option or the REST passthrough, the same way the gateway tools already masked them.
• Writing back a masked gateway setting keeps the stored credential instead of overwriting it.

• Pro: Change FunnelKit funnels through FunnelKit itself. Agents can create, rename and delete funnels, add, reorder, enable, disable, publish and delete steps, and set checkout products with quantity and discount, seeing the price a buyer pays first with dry_run. Every change can be rolled back.
• Fixed a fatal error on REST requests on stores where the only MCP adapter loaded is the older copy bundled with WooCommerce.

• Fixed: on sites running the MCP Adapter plugin from WordPress.org (0.7.0), confirm prompts and background tasks work again for 2026-07-28 clients over HTTP, and tool listings carry their output schemas again.
• The test gate can now run the whole suite against the latest released MCP Adapter plugin, so a future adapter release that breaks WP MCP is caught before it reaches sites.

• New (paid tier): Amelia bookings. On sites running Amelia, agents can read the booking setup, categories, services, employees with their working hours, customers, appointments, free slots, events with places left and event attendees, and create or change categories, services and customers, book, reschedule, approve, cancel or reject appointments. No new tools: the operations sit on the existing plugin-data pair.
• Every booking change goes through Amelia's own checks, so a taken slot or a time outside working hours is refused with Amelia's reason. Times are in the site's timezone and stay right across daylight-saving changes. Customer emails are held unless the agent asks to notify, and each answer lists what Amelia sent. Every change can be undone with rollback-operation, which never re-sends anything and is refused while later bookings depend on it.
• Amelia customer records are now included in Tools > Export Personal Data and Erase Personal Data.

• Internal: no change to the plugin itself. This release carried the notes for the FluentCRM and MailPoet campaigns work, which shipped in 0.8.151 and is now listed there.

• Internal: the changelog lists the WordPress 6.9 global styles fix under 0.8.145, the release that shipped it. No change to the plugin itself.

• Security: local-live sync no longer reads or writes in-admin chat conversations or agent memory entries. Change sets exclude them by id or by session, and apply-change-set refuses them even when forced.
• Sync never exports or writes WP MCP's internal bookkeeping meta (chat state, memory rule fields, staged-edit links), and apply checks the post an entry resolves to as well as the type it claims.

• Security: rolling back a session or operation no longer lets a user undo a site or store setting they could not change themselves. WooCommerce settings changes now take manage_woocommerce to roll back, and a settings snapshot that names no capability takes manage_options.
• Menu location, sidebar widget, plugin activation, theme switch and integration settings changes record the capability they took, so the people who made them can still roll them back.

• Security: BuddyPress group members of a private group are now listed only to its members and moderators, and pending or banned rows only to the group's admins and mods.
• Security: BuddyPress activity posted in a private or hidden group is no longer listed to callers who cannot access that group.

• Approving an OAuth client again no longer undoes the access level a site owner set on that connection: a read-only level or scoped identity binding stays in place, and the consent screen says so.

• Security: save-as-template now keeps a page's protection. A template saved from a password-protected page keeps the password, and one saved from a private or unpublished page is created private, so lower roles can no longer read that content through the template.
• Pro: FluentCRM and MailPoet campaigns, bulk import and automations. Agents can draft, edit and duplicate campaigns, send a test to themselves, import contacts without resubscribing anyone who opted out, and switch automations on or off, through each plugin's own API, with rollback-operation to undo each.
• Sending a campaign to real recipients is off until a site enables it, and always asks for confirmation with the recipient count first. Mail cannot be unsent, so a send or a test is never undone.

• Development: every push is now tested on the WordPress 6.9 minimum as well as 7.1, and a failing test run no longer skips the checks after it.

• Internal: the changelog now lists the WordPress 6.9 global styles fix under 0.8.146, the release that shipped it. No change to the plugin itself.

• New (Pro): FluentCRM and MailPoet contacts, lists and tags. Agents can read contacts, lists, tags, custom fields, campaigns and automations, and create, update, tag, list and delete contacts and lists through each plugin's own API, so its hooks, automations and opt-in rules run. Every write can be undone with rollback-operation.
• New contacts follow each plugin's opt-in rules. A contact who unsubscribed or bounced is never added back to a list, and an undo never sets them back to subscribed.

• Undoing a BuddyPress group create no longer deletes other members' data: once someone else has joined, been invited, been notified or posted in the group, the undo is refused with the reason and nothing is deleted.
• Undoing a BuddyPress group create that holds only its own rows now deletes the group through BuddyPress itself, so no activity is left pointing at the deleted group.

• New: TablePress tables (paid tier). Agents can list, read, export, render and find where a table is placed, create tables, edit cells, insert and delete rows and columns, update options, copy, rename the id, delete, import CSV, JSON or HTML, and place a table on a page, all through TablePress's own table model. Every write is snapshotted and can be rolled back.
• TablePress ops run on the existing plugin-data tools, so they add no tools where those tools already appear, and edits that would leave a table with rows of unequal length are refused.

• New opt-in setting on the Connection screen, "Delete all WP MCP data when the plugin is deleted" (or define WPMCP_UNINSTALL_DELETE_DATA in wp-config.php): deleting the plugin then also removes its tables, settings, credentials and backup archives on every site. Off by default, so your data is kept.

• Turning it on also revokes the application passwords WP MCP issued.

• Fix: on WordPress 6.9, administrators without the unfiltered_html capability (multisite site admins, or sites that disallow unfiltered HTML) can save global styles again; palette changes were refused and rolled back whenever the styles contained a "/".

• New: limit who can manage WP MCP to chosen administrators, from the Connection screen or with WPMCP_MANAGEMENT_ADMINS in wp-config.php. By default every administrator can still manage it, so nothing changes until you set a list.
• Administrators left off the list lose the WP MCP menu, screens and admin actions but keep the rest of wp-admin, and what agents may do is still decided by identities and governance. An invalid constant value closes management until it is fixed.
• New WP-CLI recovery command: wp wpmcp management-access reset lets every administrator manage WP MCP again (refused while the constant is defined).

• WP MCP now takes part in WordPress's personal data tools: Tools > Export Personal Data lists a person's records from WP MCP's undo snapshots, activity logs, agent memory, search index and (Pro) chat, and Erase Personal Data removes them.
• An erasure redacts the person inside undo snapshots instead of deleting them, and a redacted snapshot refuses to roll back with the reason, so erased data cannot be restored.
• Large snapshot tables are processed in pages, and WP MCP's erasure runs after other plugins' own, so their copies in WP MCP's snapshots are covered too.

• Fixed: duplicate-post now keeps the password of a password-protected post on the copy, so a duplicate is protected exactly like its source.
• Fixed: duplicate-post with include_children no longer copies a password-protected child the caller cannot edit; skipped children are listed in the response.

• Security: the content and store tools now follow WordPress's publishing permissions. Creating a post, page, product or coupon needs that type's create capability, and publishing, scheduling or making it private needs its publish capability, so Contributors can save drafts and submit for review but no longer publish, and Authors can no longer create pages. Editors, Administrators and Shop Managers are unaffected.

• OAuth sign-in from MCP clients now works on sites installed in a subdirectory and on subdirectory multisite subsites: the authorization server metadata is also served at the site's /.well-known/openid-configuration address, and a network's main site answers the domain-root discovery addresses for its subsites.
• The Connection screen now lists the OAuth discovery addresses MCP clients use for this site.

• update-settings and get-settings now cover the site language (WPLANG), timezone (an identifier such as Europe/Berlin, or a UTC+N offset), date format, time format and first day of the week, each change undoable with rollback-operation.
• Selecting a language that is not installed yet installs its core language pack first (needs the install_languages capability and direct filesystem access); an unknown locale or a failed install writes nothing and says why.

• New: upload-media can add PDFs, videos and other large files without sending the bytes through the chat. Pass an https url to import any allowed file type from a public address, or grant: true to get a short-lived, single-use upload link and a ready curl command for a file on your machine.
• Files from a url or an upload link get the same name checks, type sniffing and blocked types as base64 uploads, are capped at the site's upload limit, and can be undone with rollback-operation. Private addresses and redirects are refused, and upload links are tied to the user who asked for them and logged in the governance audit log.

• Fix: deactivating the plugin now removes all of its scheduled events (the OAuth clean-up, backup schedules and background jobs); reactivating restores only the schedules your settings still ask for, at their configured times.
• Background jobs still waiting to run when the plugin is deactivated are marked canceled, with the reason recorded, rather than left queued.
• Uninstalling the plugin now leaves none of its scheduled events behind.

• Form, course and lesson listings now show only the items you are allowed to read: other users' drafts and private items no longer appear in SureForms and MetForm form lists, LMS course lists and course outlines, and totals count only what you can see.
• Duplicating a post with its children now copies only the child posts you are allowed to read.

• sideload-image can now generate an image from a prompt (with an optional ratio) through the AI provider the site owner connected under Settings > Connectors on WordPress 7.0 and later, and saves it to the Media Library with alt text, the prompt and the model recorded. Calls are refused with a clear reason when no image-capable provider is configured.
• sideload-image now requires the upload_files capability, and every image it adds can be undone with rollback-operation.

• New: recurring backups. trigger-backup can now run a backup type daily or weekly at a set site time, keeping only the newest scheduled archives you choose to retain; manual backups are never pruned and a failed run deletes nothing.
• list-backup-jobs now shows each backup schedule with its next run, the last run's outcome, and an overdue flag when WP-Cron falls behind.
• Schedule changes require the manage_options capability and are recorded in the governance audit log, along with every archive retention removes.

• Security hardening: event and donation form listings (The Events Calendar, Modern Events Calendar, GiveWP) now show only the entries the current user may read, and their totals count only those.
• The operation log (list-operations) shows non-administrators only their own changes, and a change can no longer be added to a named session another user started unless you are an administrator. The shared default session and new session ids work as before.
• WooCommerce catalog ops (woo-read, woo-write) now check the per-item permission for every product, variation, coupon, order, refund, customer, review and brand they name before running.

• Content writes now refuse a post another user has open in the editor, naming who holds it and when their lock was last refreshed, and write nothing. Your own open editor and expired locks never block, reads and previews are never blocked, and undo waits until the editor is closed.
• On Elementor 4.3 and later, writes also honor Elementor's unsaved-changes guard, and an open Elementor editor is told when a document changed underneath it.
• New filter wpmcp_respect_edit_locks turns the check off site wide.

• New: when you approve an MCP client over OAuth you now choose its access: full, read-only, or (site owners) one of your scoped identities. Read-only connections can list and read but are refused anything that changes the site. Clients connected before this update keep full access until you change them on the Connection screen.
• The Connection screen lists every application connected through OAuth with its access level, and lowering it takes effect on its next request without reconnecting.
• Security: OAuth tokens are now limited to the scope they were granted, the scope never grows when a token is refreshed, and the authorization server advertises the mcp and mcp:read scopes.

• Security hardening: get-post no longer returns the content or excerpt of a password-protected post to a user who cannot edit it (it reports protected instead, as the REST API does), other reads of that content are refused, and search no longer matches inside it.
• Security hardening: integration pack operations (ACF, Meta Box, JetEngine, Pods, forms, events, LMS, block suites and others) now check the per-object capability for every post, user or entry id they are given, before the operation runs.
• Security hardening: rollback-session only rolls back sessions the caller started, unless they can manage options; sessions written with no user account are administrator-only, and the shared default session still works row by row.

• Fix: pages built with Breakdance 1.x are now detected, readable and editable. The builder tools read and write whichever layout key a page uses, and rollback restores that same key.
• Breakdance 1.x templates now show their display conditions in the builder design reads.

• File edits to PHP files are now checked: a file that does not parse is refused with the line of the error, and an edit that causes a fatal error on the front end or in admin is reverted automatically in the same call.
• When the site check cannot run on a host, PHP file writes are refused unless you explicitly allow an unchecked write, and the response says the file was not checked.

• Page builder design systems are now editable: update-builder-content can add, update and remove Bricks global classes, variables and palette colors, and Breakdance classes and palette colors, each change undoable with rollback-operation and refused if the data changed since it was read.
• Fixed the Breakdance design system read returning empty classes and palettes on real installs.

• Security: the content tools now apply WordPress's per-post permissions. Contributors and Authors can only change, delete or undo changes to posts they are allowed to edit, and can only read other users' drafts and private posts when WordPress would let them. Editors and Administrators keep full access.
• list-posts and search-content only return posts the caller may read, and list-posts totals and page counts reflect that.

• Security: the content tools now require each post type's own capabilities. A non-public post type needs that type's edit capability, and one without an admin screen is refused below administrator, so Contributors, Authors and Editors can no longer read other plugins' private records (such as enrollments, orders or form entries) through the generic post tools. Some calls that used to succeed are now refused.
• New filter wpmcp_agent_readable_hidden_post_types opens specific non-public types without an admin screen to users who hold their capabilities.
• list-posts with post_type "any", search-content and count-content now leave out post types the caller may not read.

• Pro: Tutor LMS and LifterLMS course structure. Agents can read a course as a tree of sections (Tutor LMS topics), lessons and quizzes with their questions, create courses, add sections, lessons and quizzes, edit and reorder them, and every change can be undone with rollback.
• Pro: Read course enrollments for Tutor LMS and LifterLMS (student, status and date). Enrollments are read-only and need the same permission as listing users.
• Fix: trashing a Tutor LMS course through the tools, or rolling back its creation, no longer ends the request early.

• rollback-session now refuses a run whose undo points were pruned however long ago it happened, and says clearly when no undo points were ever recorded under a session id.
• Find and replace in content can now apply a pass larger than the snapshot history limit; the whole pass stays undoable with rollback-session.

• Content edits (block updates, builder saves, find and replace, mirror restores, site template and global styles saves, change set syncs, stage publishing and the accessibility fix passes) no longer rewrite a post's unchanged title and excerpt for users without the unfiltered_html capability.
• The content being written is still filtered exactly as before, and a new check keeps future write paths from re-saving untouched columns.

• Bulk runs recorded under one session (background media optimization, product imports, multi-call database cleanups) now stay fully undoable with rollback-session after later changes on the site: snapshot history keeps or drops a session as a whole instead of cutting it to the history limit.
• The most recent run is always kept whole, whatever its size, and ordinary single changes still keep the last 20 (or your wpmcp_snapshot_history_limit) as before.
• rollback-session now refuses, with the reason, a session whose undo points were pruned, instead of silently undoing only part of it.

• Changing a site part, custom widget, custom block or memory entry status, moving content to the trash, or editing only a title, status or meta field no longer rewrites the stored content, excerpt or title for users without the unfiltered_html capability.
• Status transition hooks still fire as before, and fields a tool does change are still filtered.

• Pro: optimize-media can now run over the whole Media Library in the background, with progress you can check and one undo for the entire run.
• Pro: New opt-in settings optimize images uploaded through the tools automatically and serve the WebP/AVIF copies on the front end through picture/srcset, falling back to the original. Both are off by default and step aside when another image optimizer is active.
• Deleting an optimized image now also removes its WebP and AVIF copies.

• Fixed: undoing the creation of a custom widget, custom block or post no longer rewrites its stored content, excerpt or title for users without the unfiltered_html capability (common on multisite).

• Fixed: rolling back a post as a user without the unfiltered_html capability (for example an Author) now restores its content, excerpt, title and custom fields exactly as they were stored, instead of running them through the HTML filters again.
• Normal post edits by the same users are still filtered as before.

• Pro: New optimize-media compresses Media Library JPEG and PNG images, can cap their dimensions and writes WebP and AVIF copies using your server's own image editor, reporting bytes saved. Nothing is sent to an outside service.
• Every optimization keeps a backup of the originals, so rollback restores the exact files and removes the generated copies. Large libraries are processed in short batches with a cursor, a dry run estimates the savings first, and formats the server cannot produce are reported with a reason.

• Rolling back a comment, term or user edit now restores the stored text exactly, including HTML, block markup and a lone less-than sign, instead of running it through the save filters again.

• Backslashes now survive every content write: posts, pages, excerpts, meta, terms, menus, comments, users, media details, Elementor settings and code snippets keep escaped block markup, JSON escapes and literal backslashes byte for byte.
• Rolling back a user, comment or term edit now restores backslashes exactly.

• New: site-wide governance. A default-off site_wide setting on update-governance-settings logs ability calls made outside the MCP endpoint (the core abilities REST route, other servers, WP-CLI or other plugins' PHP), for third-party abilities as well as wpmcp's own, and in enforce mode refuses abilities you disabled by name on every entry point.
• Every governance audit log entry now records where the call came from (mcp, rest, server, cli or php), and list-governance-audit-log can filter by it.
• A call through the MCP endpoint or the core REST run route now leaves one audit entry instead of two.

• Stage edits to a live page: duplicate-post can make a private draft copy of a published post, page or custom post type entry, then publish it back over the original (same ID, URL, author, date and comments, undoable in one step) or discard it. Publishing refuses if the original changed since the copy was made, unless forced.
• Duplicating a post now keeps block markup escapes and Elementor data byte for byte.

• scan-security can now check WordPress core, installed plugins and installed themes against the free WPVulnerability database with vulnerabilities:true, reporting each match with its identifier, severity, affected range and fixed-in version, and pointing the fix at update-plugin, update-theme or manage-updates.
• The lookup is opt-in, sends only slugs and the core version, is cached for a day, and reports any component it could not check as unchecked rather than clean. The service is listed under External services in the readme.

• New: database cleanup on delete-transient. A dry run (the default) reports how many expired transients, old revisions, stale auto-drafts, trashed items, spam comments and orphaned meta rows would go and the space it frees; a confirmed run deletes them in bounded batches with a cursor to continue.
• Every cleaned-up revision, draft, trashed item, spam comment and meta row is snapshotted first, so rollback-operation restores it; expired transients are cache data and are not restored. Items the snapshot could not restore (attachments, parents of other posts or replies) are skipped and reported.

• Fix: Site Health, content export and broken-link scan tools no longer advertise themselves as read-only, since they can send a test email, write an export file or queue a background scan. Clients that auto-approve read-only tools now ask first.
• New: a registry check keeps any tool that can cause a side effect from advertising itself as read-only.

• Scoped identities can now be pinned to IP addresses and CIDR ranges (IPv4 and IPv6) with the new allowed_ips option on create-identity. Requests from any other address are refused before any tool runs and recorded in the audit log.
• Client addresses come from REMOTE_ADDR. Forwarded headers are only honored from reverse proxies you list with the new wpmcp_trusted_proxies filter, so they cannot be spoofed.
• The Connection screen now lists each scoped identity with its allowed addresses.

• Site Health can now check mail delivery: it reports how the site sends email (PHP mail, SMTP or a mail service plugin, and the effective From address) without exposing credentials, and can send one confirmed test message to your own address or the site admin email.
• Test emails are rate limited, recorded in the audit log, and return the exact failure reason when sending fails, with suggested next steps.

• Fixed the comment edit and delete tools, which refused every user including administrators. They now work for administrators and editors, and still check that the caller may edit the specific comment.
• Added a registry check that stops any tool from shipping with a capability no WordPress role can hold.

• New: get-builder-content can read the site-wide design system of Bricks, Breakdance and Oxygen 6: global classes, variables and color palettes, local templates including headers and footers, and the element catalog with each element's control schema.

• New: incident response. incident-response lists and revokes application passwords (never showing secrets), ends login sessions for one user or everyone, rotates the keys and salts in wp-config.php with a backup, and reinstalls core files the security scan flags from the checksum-verified official package, undoable with rollback-operation.
• Every incident-response write needs confirm:true and is recorded in the audit log. Your own session and application password are kept unless you ask, and salt rotation refuses when wp-config.php is not writable or the salts are defined elsewhere.

• Destructive tools now ask you to confirm through your MCP client when it supports elicitation, instead of refusing until the agent passes confirm:true; clients without it keep working exactly as before.
• Backups and background WP-CLI jobs run as MCP Tasks on 2026-07-28 clients that support the Tasks extension, so they can be polled and cancelled as tasks.
• Every tool now declares an output schema describing its structured result.

• New: manage-updates applies WordPress core updates (and pending database upgrades) only with confirm:true and a fresh full-site backup, with an optional expected-version guard, and toggles plugin and theme auto-updates as undoable changes.
• New: list-plugins with updates:true lists available core, plugin and theme updates together with their auto-update state.

• New: read and restyle block themes through global styles. site-templates-read and site-templates-write take entity global_styles to read the theme, user and merged theme.json layers, patch palette, font, element and block styles by path, apply a style variation or reset, each write undoable.
• Global styles patches are checked against the theme.json schema and safe CSS rules before anything is saved, and classic themes are told that global styles do not apply.

• Fix: Elementor padding, margin, border radius and gap values written by the Elementor tools now show their real numbers in the Elementor editor panel instead of 0.

• New: MCP clients can now sign in through OAuth with a client metadata document (an https URL as their client ID), the registration method the MCP authorization spec now prefers. Dynamic client registration keeps working for older clients.
• The client's document is fetched only while a signed-in user authorizes it, refusing private addresses and redirects, capped in size and cached. See External services in the readme.
• Site owners can require approval for new OAuth clients, and approve or block them, on the WP MCP Connection screen. Blocking a client revokes its tokens.

• New: agents can edit block theme templates, template parts (header, footer and the rest) and navigation menus, with every change undoable.
• A customized template can be reverted to the theme's own file, and undoing the revert brings the customization back.

• Elementor edits now succeed on pages that contain a widget registered only on some requests (for example a checkout widget), and that widget is kept intact instead of the edit being rolled back.

• New: find-unused-media lists Media Library attachments that nothing on the site references, checking featured images, the site logo and icon, post content, page builder data, post and term meta, and options, with each file's size on disk.
• find-unused-media pages through large libraries with a cursor and a time budget, states the checks it ran for every result, and can list unattached attachments separately, since unattached does not mean unused.

• New: agents can read and manage robots.txt rules, an llms.txt built from chosen pages, and which post types, taxonomies or posts appear in the WordPress XML sitemap, with every change undoable.
• A physical robots.txt or llms.txt, or an SEO plugin that serves its own sitemap or llms.txt, is reported and never silently overridden.

• Ready for the next WordPress MCP adapter: both the HTTP endpoint and the stdio transport now speak MCP protocol 2026-07-28 (sessionless discovery via server/discover) alongside 2025-11-25.
• When the canonical MCP Adapter plugin is active, WP MCP now uses it instead of its bundled copy, so the two never conflict.
• The server card lists every protocol revision the endpoint answers.

• New: get-site-health runs the Site Health tests, including those other plugins add, and returns each result's status, label, badge, description and recommended action as plain text.
• Async Site Health tests run within a time bound (default 10 seconds, up to 30); any that do not finish in time are reported as not completed instead of holding the call open.
• get-site-health can run a subset of tests, or return the last full run from cache without rerunning anything.

• Pro: Browse and import Spectra's remote pattern library through the block suite pattern tools while Spectra is active. Only free Gutenberg block patterns are offered, each import is one undoable write, and its images are brought into the Media Library through the same guarded download as other remote media.
• The library is contacted only when an agent asks for it, with no license key and no site address sent, and answers are cached for a day. See External services in the readme.

• FunnelKit funnel reads now give a stable reason code with every count or list they cannot read, so an unavailable value is never mistaken for zero or none.
• FunnelKit upsell steps find their offers through the upsell add-on itself when it is active, with fallbacks to the stored offer list, and each offer reports its views and accepts.

• New: classic Oxygen (4.x and earlier) pages can now be read and edited structurally through get-builder-content and update-builder-content. Update, add, remove or move one element by path, or replace the whole tree; untouched elements, including ones wpmcp does not know, keep their exact bytes, and every write is undoable with rollback.
• Classic Oxygen writes keep the JSON tree and Oxygen's signed shortcode copy in step through Oxygen itself, add an Oxygen revision, and refresh the page's generated CSS after writes and rollbacks. Pages still in the pre-4.0 format are read-only until saved in Oxygen 4.
• The content mirror now exports and restores classic Oxygen pages.

• Fix: rolling back a BuddyPress write now restores only the rows it saved, by id, so membership requests, notifications and replies that other members add after the write are kept.
• Fix: rolling back an activity change keeps the thread's reply numbering consistent when someone replied after the write.

• Fixed: rolling back a BuddyPress write no longer removes activity, notifications or other rows that someone else added while the write was running. Only the rows the write itself created are removed.
• Rollback now leaves in place, and reports, any row the write created that has since changed hands.

• New: Thrive Architect pages can now be read and edited structurally through get-builder-content and update-builder-content. Update, add, remove or move one element by path, or replace the whole layout; untouched markup, including elements wpmcp does not know, keeps its exact bytes, and every write is undoable with rollback.
• Thrive writes keep the Read More excerpt in step and make the page load Thrive's full styles and scripts until it is optimized again, so edited elements never render unstyled.
• The content mirror now exports and restores Avada, Oxygen 6 and Thrive Architect pages.

• Fix: BuddyPress writes now run through BuddyPress itself, so its hooks fire. A group created through the tools gets its "created the group" activity item, and add-ons listening for group, profile field and activity changes now hear about them.
• Rolling back a BuddyPress write also removes what BuddyPress added in response (activity items, notifications, accepted memberships) and puts back membership requests and thread numbering it changed.

• FunnelKit funnel reads now say why a count or offer list is unavailable, such as a paid FunnelKit add-on not being active, instead of returning zero or an empty list.
• FunnelKit step views are no longer reported as zero on sites where nothing records them.

• New: Avada (Fusion Builder) pages can now be read and edited structurally through get-builder-content and update-builder-content. Update, add, remove or move one element by path, or replace the whole layout; untouched elements keep their exact markup.
• Avada's per-page dynamic CSS is invalidated after every Avada write and rollback, so the page recompiles its styles instead of serving the old ones.

• Pro: Browse and import patterns from the WordPress.org Pattern Directory through the block suite pattern tools. Each import is one undoable write, and its images are brought into the Media Library through the same guarded download as other remote media.
• The Pattern Directory is contacted only when an agent asks for it. Answers are cached for an hour, and the site address is not sent. See External services in the readme.

• Security: rolling back a deleted post no longer restores commenters' email addresses, IP addresses or user agents for users without the moderate_comments capability. The post and its comments still come back, with those fields blank, and the rollback response says so.

• New: Oxygen 6 pages can be read and edited through the builder tools: detection, a node tree read, and node updates, adds, removes and moves or a whole-layout write, each undoable with rollback.
• Oxygen writes keep the stored layout byte for byte outside the edited nodes, including elements wpmcp does not know, and refresh the page's generated CSS through Oxygen when it is active.
• Page snapshots of Oxygen 6 pages now count elements and responsive overrides from the stored layout.

• Pro: Spectra blocks inserted by an agent now render with their styles on the front end. New blocks get the same selector settings Spectra's editor gives them.
• Block suite support is now checked against the real Kadence Blocks, GenerateBlocks, Spectra and Otter Blocks: each inserted block renders with markup and generated styles that match its unique id, and edits and rollbacks show up on the page right away.

• Pro: Read FunnelKit funnels and their steps. Agents can list funnels and see each step in order with its linked page, linked products, status and basic view and conversion counts, and no customer data is ever returned.

• New: BuddyPress integration. Read groups, group members, the activity stream and extended profile fields; create and update groups, edit profile field definitions, and hide or delete activity items, all snapshotted and undoable with rollback. The tools appear only while BuddyPress (or another supported data plugin) is active.
• Member email addresses are only shown to users who can list users, and activity meta such as IP addresses is never returned.

• get-rendered-html can now continue a read from a byte offset, returns the next offset to read from, and includes a content hash so agents can tell when a page changed between reads.
• get-rendered-html now checks that you can read the requested post, and explains that drafts cannot be rendered because the page is fetched as a logged-out visitor.
• get-rendered-html keeps every request pinned to this site's own address and never forwards cookies or login credentials.

• Pro: Spectra, Otter Blocks and Blocksy companion blocks join the block suite support. Agents can read their block schemas and insert or update their blocks with correct unique ids, and each suite's cached styles are rebuilt after writes and rollbacks.
• Pro: Browse block patterns by the block suite they use and import one into a post in a single undoable step. Remote images are brought into the Media Library through the same safe download checks as other remote media.

• WooCommerce payment gateways: list and read gateway settings with every key, secret, password and token masked, and change a gateway's enabled state, title, description, order or non-secret settings, with each change snapshotted for exact rollback.
• WooCommerce system status: read the status report by section with secrets masked, list the status tools, and run allowlisted maintenance tools such as clearing transients or regenerating lookup tables. Tools that delete data need confirm, and every run says why it cannot be rolled back.

• Security: undoing a change to a comment or product review now requires the capability to moderate comments (and, for a review, to edit its product), because the saved copy holds the commenter's email and IP address.
• Change sets and history never show a commenter's email, IP address or browser details.

• New: read-only status for UpdraftPlus, Duplicator, Solid Security, MonsterInsights and W3 Total Cache (last backups and schedules, backup packages, enabled security modules and last scan, analytics connection and tracking settings, enabled caches), with credentials and IP addresses never returned.
• New: purge every W3 Total Cache cache with purge-w3tc-cache (needs confirm).

• Internal: the bundled compliance checker no longer reports superglobal names that appear only in code comments or docblocks.

• New (Pro): analyze-seo can look up keyword search volume, difficulty, CPC and intent, and backlink counts for a domain or URL, from your own DataForSEO account. Save the credentials once with set-seo-data-key; they are stored encrypted and never returned.
• Lookups are cached for a day and back off automatically when the provider rate-limits, and without saved credentials nothing is sent.
• The External services section discloses the new, opt-in call to the DataForSEO API.

• New: product review moderation on the WooCommerce ops. List reviews by product, rating and status, approve, hold, mark as spam, trash, edit the text or reply as the store; every change can be rolled back exactly, rating and verified flag included.
• New: read-only WooCommerce totals reports for sales (by day, week or month), top sellers, orders by status, customers and coupons. They use the store's analytics tables when those are up to date and fall back to order queries otherwise, and return aggregate figures only.

• New: a git-friendly content mirror. export-content with mirror:true writes builder page data (Elementor, blocks, Bricks, Divi, WPBakery, Beaver Builder, Breakdance) as stable, pretty-printed JSON files under uploads, one per page.
• New: import-content with mirror:true restores a page from its mirror file as a snapshotted write that rollback-operation undoes.
• Fix: backslashes in Divi shortcode content are kept when the content is written.

• Fixed: empty cells in the admin ability grid show a plain hyphen.

• Internal: code comments and documentation cleanup, plus a shared cache helper for global variables. No change to plugin behavior.

• New: JetEngine, Pods and TranslatePress integrations. Read field definitions and read or write post field values for JetEngine and Pods (including Pods table storage), and read or write TranslatePress string translations, all snapshotted and undoable with rollback. The tools appear only while one of these plugins is active.
• Field value writes for JetEngine and Pods are off until a site opts in, the same as ACF and Meta Box.

• New: Breakdance pages can be read and edited through the builder tools: detection, a node tree read, and node updates, adds, removes and moves or a whole-layout write, each undoable with rollback.
• Breakdance writes keep the stored layout byte for byte outside the edited nodes and refresh the page's generated CSS through Breakdance when it is active.
• Page snapshots of Breakdance pages now count elements and responsive overrides from the stored layout.

• Fix: rolling back a shipping zone creation now removes the zone only while it is still the zone that was created; a different zone that reuses the id is left in place and the skipped restore is reported.
• Fix: rolling back a session that created and then edited or deleted a shipping zone now unwinds the edits first, newest first, before undoing the create.

• New: single, archive and search templates with dynamic data bindings. Bind post title, content, excerpt, featured image, author, date, permalink, terms, site name, tagline and logo, plus ACF fields when ACF is active, with display conditions and escaping per field type.
• New: list-dynamic-sources shows every bindable field for a template context, and template updates are snapshotted so one rollback restores them exactly.

• New: agents and directories can discover this site's MCP server before connecting, through a public server card, an AI catalog at /.well-known/ai-catalog.json and an agent skills index at /.well-known/agent-skills/index.json.
• Discovery documents carry public metadata only: no user data, and no disabled, paid or site-custom tools or skills are advertised. A filter turns them off.

• Fixed: a Redirection redirect create that is refused at the last moment no longer leaves an undo point behind, and undoing a create never removes a different redirect that took its place.
• Rolling back a whole session that created a Redirection redirect and then edited it now removes the redirect as expected.

• New: Redirection plugin support. Agents can list its groups and redirects and create, edit, enable, disable or delete redirects, with every change undoable.
• Redirects written through the Redirection plugin refuse loops, duplicate sources and unsafe targets before anything is saved.

• Custom widgets can now show live data: post, product and term lists, a navigation menu, breadcrumbs, the WooCommerce cart, and values from a remote JSON feed.
• Remote JSON is read only from https hosts you allow with the wpmcp_remote_json_allowed_hosts filter, never from private addresses, with a timeout, a size cap and caching.

• Pro: Kadence Blocks and GenerateBlocks support. Agents can read each suite's block schemas and insert or update its blocks with valid attributes and correct unique ids, and the blocks render with their generated CSS.
• Every block suite write is snapshotted and rolls back exactly, and GenerateBlocks' cached per-post CSS is rebuilt after both writes and rollbacks.

• Fix: the WooCommerce build no longer crashes when undoing a settings change. Any site on that build should update.
• The release builds now refuse to ship a hook that points at code the build leaves out.

• New: Elementor addon suite packs for Essential Addons, Premium Addons and Ultimate Addons. Agents can list each suite's widgets with their controls and switch its modules on or off, with every toggle undoable.
• Module toggles write the suite's own settings in its own format and are skipped cleanly when a suite is not active.

• New: extract-content can return a post's top keywords and 2 to 3 word phrases (pass keywords=N), ranked by frequency with the title and headings weighted higher.
• Keyword extraction reads builder content (blocks, shortcodes, Elementor and Bricks) as plain text, keeps non-English words whole and drops stopwords for the site language.

• New: manage WooCommerce shipping zones and methods (flat rate, free shipping, local pickup) and store webhooks through the woo-write tool. Every change can be rolled back exactly.
• Webhook signing secrets are never shown in responses, and delivery URLs must be public https addresses.

• Installing a plugin or theme from an uploaded ZIP no longer waits on the WordPress.org update check, so installs and their rollbacks work on sites without outbound network access.
• The test suite now fails any test that makes an unmocked HTTP request.

• New: export stored PHP snippets, custom blocks and custom widgets to one portable, checksummed JSON bundle and import it on another site, no cloud account needed. Every imported item lands inactive and is re-checked by its own store.
• Import refuses name collisions unless you ask it to rename, and the whole import can be undone with one rollback-session.
• Fix: a custom block keeps its name when its stored spec is saved again, instead of gaining a doubled "wpmcp-" prefix.

• New: create and edit WooCommerce orders through the woo-write tool (orders.create and orders.update): line items, addresses, shipping and fee lines, coupons, status and notes, with totals recalculated. No payment gateway is ever charged.
• Every order edit takes a full snapshot of the order, its items and totals, so rollback restores it exactly on both HPOS and legacy order storage; rolling back a created order moves it to the trash and returns its stock.

• Rolling back a post, page or ACF field group, post type or taxonomy now restores its last-modified date exactly, instead of resetting it to the time of the rollback.

• SEO support now covers Slim SEO, and with Pro, All in One SEO: titles, descriptions, canonical, robots and social fields per post and per term through the existing SEO tools.
• All in One SEO edits are snapshotted from its own tables and roll back exactly.

• WooCommerce brands: create, update, delete and assign product brands through the WooCommerce catalog ops, with every change snapshotted so rollback restores it exactly.
• Brand images must be an existing Media Library image or pass the remote media guard, and deleting a brand needs confirmation and reports how many products use it.

• The Requests tab of the audit log can now be filtered by date, user, tool and outcome, and exported as CSV for review.
• The CSV export is administrator-only and redacts tokens, secret-looking arguments and arguments a tool marks as secret.

• Undoing a theme settings change for Astra, Kadence, GeneratePress or Blocksy now refreshes the theme's generated CSS, so the site shows the restored styles right away.
• The refresh only runs for the active theme; rolling back settings of an inactive theme leaves its caches untouched.

• New: Beaver Builder pages can be read and edited through the builder tools: detection, a node tree read, and node updates, adds, removes and moves or a whole-layout write, each undoable with rollback.
• Beaver Builder writes keep the editor's draft in step with the live layout, refuse pages with unpublished editor changes, and clear the page's layout CSS and JS cache.
• Fix: rolling back a post now keeps backslashes inside object-valued post meta exactly as they were.

• New theme settings packs for Kadence, and for GeneratePress and Blocksy (Pro): read and change global colors, typography, container width and basic header and footer settings through each theme's own storage. Every change is snapshotted and restorable with rollback, and a pack only appears while its theme is active.

• New: create-comment and reply-to-comment post a comment or reply as the current user, approved (for moderators) or held for moderation.
• Comments created this way are part of the undo history: rollback-operation and rollback-session move them to the trash, so they can still be restored.

• New: WPBakery page support in the builder tools. Detect WPBakery pages, read their layout as an element tree, and update, add, remove or move elements, with every change undoable through rollback.

• New: create, update, move and delete classic sidebar widgets (including block widgets) with create-sidebar-widget, update-sidebar-widget, move-sidebar-widget and delete-sidebar-widget. Settings are sanitized by each widget's own update routine.
• Every widget change saves the widget's settings and the sidebar layout as one undo point, so a single rollback restores both.

• New: get-preview-link returns the preview URL for a draft, pending or scheduled post you can edit, so an agent can share a link to review before publishing.

• New: install a plugin or theme from a ZIP uploaded to the Media Library (off by default, requires confirm and the file's SHA-256; unsafe archives are refused before extraction, and rollback restores the previous version or removes the new one).
• New: search the wordpress.org theme directory.

• New: author ACF structure from an agent. Create and update field groups and their fields, register ACF post types and taxonomies, read and write options pages, list field types and validate values, all through the existing ACF tools with snapshot-first rollback.
• New: batch-update ACF field values across many posts in one call; the whole batch is validated first and runs under one session, so a single session rollback undoes it.
• Fix: rolling back a custom post type now restores its GUID exactly.

• New: the skills library is now available as MCP prompts and site context as MCP resources, so clients that support prompts and resources can use them directly. Both follow the same permissions and governance as the matching tools.
• New: prompts and resources work over both the HTTP and the WP-CLI stdio connection.

• Rolling back a session now moves posts it created to the trash: create-post, duplicate-post, create-custom-widget and create-custom-block record their creations in the undo history, so rollback-session and rollback-operation trash a created post (restore it from the trash) and deactivate a created widget or block spec. Nothing is permanently deleted.
• A change set built from a session now lists the posts, pages and widget or block specs that session created, not only the ones it edited.

• Verified on WordPress 7.1: each release package (directory, WooCommerce and full) was installed on a fresh 7.1 site and passed an MCP session with a snapshot and one-step rollback.

• New multi-site gateway: a gateway credential can be bound to a scoped identity, is accepted only on the MCP connection, and every call it makes is narrowed to that identity and recorded in the audit log.
• New cloud gateway provisioning and status, with an explicit gateway consent on cloud connect (off by default) and a kill switch (wp wpmcp gateway-revoke) that revokes the credential locally, even offline.
• The self-hosted proxy can route a tool call to one named site or broadcast it to every site, with a separate credential and session per site and a confirm gate for broadcast writes.

• New: import WooCommerce products in two steps. plan-product-import previews every row (create, update with a field-level diff, skip or error) without writing anything, and apply-product-import writes the approved plan, including variable products, variations and images, refusing if the store changed since.
• A whole product import is one undo session: rollback-session restores the updated products and removes the products, variations and images it created.

• New: push a site backup archive to another WordPress install over a secure connection, with a dry run by default, resumable chunked uploads and a restore plus URL rewrite on the target. Both sides must opt in before any migration can run.
• Improved: rewriting site URLs now takes a database safety archive first and reports how to undo the pass.

• New: Elementor v4 global variables (color, font and size design tokens) can now be listed, created, updated and deleted, with strict type and value checks, a usage report before any delete, and one-step rollback.
• Fix: a breakpoint-only font size in Elementor global typography now enables custom typography, so tablet and mobile sizes actually render.

• New find-replace-content ability: site-wide find and replace across post content, titles, excerpts and selected post meta, preview-only by default, with every applied pass undoable in one step via rollback-session.
• Serialized and JSON meta, block attributes and page-builder data are never corrupted; unsafe items are skipped and reported.
• Fixed: rolling back a post change no longer strips backslashes from content or meta.

• New forms tools for Contact Form 7: list forms, fields and mail notifications, and read, trash, restore or delete Flamingo entries, with every status change snapshotted for rollback. Entry deletion needs confirmation and is off by default.
• Forms submissions are now treated as user data: every forms integration requires an administrator-level capability to read or change entries, and forms tools register only while their forms plugin is active.
• Pro: a forms adapter pack for WPForms, Gravity Forms, Formidable, Ninja Forms and Fluent Forms, covering forms, fields, notifications, entries and reversible entry status changes. These integrations move from the free tier to Pro.

• New WooCommerce operations catalog (Pro): discover, read and write store data across products, variations, orders, refunds, coupons, customers, shipping, taxes, webhooks and settings through WooCommerce's own REST API, with WooCommerce's permission checks as the final gate.
• Every change to existing store data is snapshotted and reversible, batches of up to 25 changes share one session for a single rollback, and changes a rollback could not undo are refused.
• Destructive store operations such as deletes and refunds are off by default, need an explicit per-site opt-in and a confirmation on every call, and refunds never contact the payment gateway unless asked.

• New get-rendered-html ability returns the rendered front-end HTML a visitor sees for a published page on this site, in chunks, with optional script stripping or text-only output, so agents can verify edits against what visitors actually get.
• get-rendered-html only ever fetches this site's own address: other hosts, IP addresses, non-web schemes and redirects that leave the site are refused, and drafts, private and password-protected posts are not fetched.

• New custom widget builder (Pro): describe an Elementor widget as a data spec and the plugin compiles it into a real widget class. The generated PHP is linted against a closed allowlist before it touches disk, and it loads only from a hardened sandbox through a hash-verified manifest, so a tampered file stops loading.
• Compiling is opt-in through a filter and refuses without the edit_files capability or when DISALLOW_FILE_EDIT is set. Every control type escapes the same way in compiled and runtime rendering.

• New: sync your governance, exposure, skills and identity settings with WP MCP Cloud, with every synced change recorded and undoable through rollback.
• New: browse the WP MCP Cloud marketplace and install widget and block specs as inactive drafts, validated and sanitized before they are stored.

• Security: MCP OAuth access tokens are now bound to the MCP endpoint and no longer authenticate any other route on the site (the WordPress REST API, admin-ajax and so on). If a connected MCP client stops working after this update, reconnect it.
• OAuth discovery now names the MCP endpoint as the protected resource, lists the supported scope, is also served at the endpoint-specific well-known address, and unauthenticated MCP responses point clients to it.
• Refresh token redemption is now atomic, so two simultaneous refreshes with the same token can no longer both succeed.

• Deeper SEO support: SEOPress is now detected alongside Yoast, Rank Math, The SEO Framework and SureRank, and SEO edits now require permission to edit the target post.
• New Pro SEO tools: read and write term-level SEO, set OpenGraph and Twitter images, read resolved social meta, and generate meta tags and JSON-LD schema (Article, WebPage, LocalBusiness, Product). Every SEO write is snapshotted and reversible.

• New gateway credential tools: provision, inspect and revoke a site-local gateway credential with no cloud dependency. The client secret and refresh token are shown exactly once, re-provisioning rotates everything, and provision and revoke both require explicit confirmation.
• Refresh tokens now stop working when the user they belong to changes their password or is deleted. Existing refresh tokens keep working and pick up this protection on their next use.

• Fixed: undoing an Elementor edit could leave the page showing the undone styling, because the generated CSS file was not refreshed on rollback. Rollback of pages, the site kit and global classes, duplicated posts, and popup and import settings writes now clear Elementor's generated CSS and element render cache.
• New regenerate-elementor-css ability: rebuild Elementor's generated CSS for one page, or for the whole site with an explicit confirmation.
• Editing a page's raw Elementor data now clears only that page's caches instead of every page on the site.

• New: upload-media adds a file to the Media Library straight from base64 bytes, for agents that hold the file itself rather than a URL. Supports title, alt text, caption and a parent post.
• The file type is checked from the actual bytes against the site's allowed upload types, executables and SVG are refused, and the size is capped at the site upload limit (filterable with wpmcp_upload_media_max_bytes). Rolling the operation back deletes the upload and its files.

• Front-end redirects now read from the object cache instead of querying the database on every page view, and the cache refreshes automatically whenever a redirect is added, changed, removed or rolled back.
• Rolling back a set of database rows now refreshes the cache for every row it restored, even when a later row fails.
• Every remaining direct database query in the plugin now carries a documented reason, clearing the last WordPress coding standards warnings for direct and slow queries.

• The WooCommerce edition now ships the same WordPress.org-ready build as the main directory plugin, with no upgrade or licensing code in the package.
• Fixed a fatal error at boot in the WooCommerce edition caused by a missing cloud client class.
• The WooCommerce edition readme now discloses the optional cloud connection under External services.

• New: WooCommerce variations can be created and deleted, and up to 50 products or variations can be updated in one call, with the whole batch undoable as a single session.
• New: manage WooCommerce coupons (list, get, create, update, delete, and validate against store rules) and tax rates (list, create, update, delete), with snapshots so every change can be rolled back.
• Deletes of variations, coupons and tax rates stay off until the site opts in, and always require confirmation.

• Cloud credentials are now stored encrypted: the cloud URL, API key and tokens are sealed in one authenticated-encryption vault keyed to your site's salts, existing plaintext settings are migrated automatically, and nothing is ever stored unencrypted if encryption is unavailable.
• Cloud access tokens refresh safely: refreshes are serialized across requests, a lost race never discards a working token, and cloud-status now reports a read-only token status.
• Secrets are scrubbed from cloud and transport error messages before they reach an MCP client, and every cloud option is protected from generic option writes.

• Hardened the release checks: an exception message that includes unescaped data now fails the automated plugin review, so this class of issue cannot return unnoticed.

• Internal: local test runs are now fully isolated from each other, even when two run in the same checkout. No change to the plugin itself.

• New: selective local-to-live sync. Build a change set of chosen pages, templates, patterns, menus and theme mods with their media, terms and template dependencies, inspect it, then apply it to another site with a dry run by default.
• Apply is snapshot-first and conflict-aware: objects changed on both sides are reported and left untouched unless explicitly forced, live-only data such as orders is never touched, and a whole sync can be undone with one session rollback.
• Objects created during a session (for example with create-post or duplicate-post) are not yet picked up automatically; list them explicitly when building the change set.

• Site backups can now be restored, not just checked: a real restore takes a safety archive first, puts the site in maintenance mode, validates every SQL statement before anything is written, and rolls back to the safety archive automatically if the import fails.
• Restores keep the acting administrator signed in when the same account exists in the restored database, can optionally swap in the backup's wp-content with a journalled rollback, and refuse to run twice at once.
• Database dumps no longer corrupt values containing a percent sign (such as permalink structures); older archives affected by this are repaired on restore with a warning.

• The External services section of the readme now names Openverse as the default, keyless stock image provider and links its privacy policy, plus the terms and privacy policy of every other listed service.
• search-stock-images falls back to Openverse when the provider is left empty, matching what the readme documents.
• The readme now discloses the WP MCP Cloud announcements check, which runs only after a cloud connection has been saved.

• New built-in theme builder: create header, footer and 404 site parts, show each one by include/exclude display conditions (entire site, front page, archives, search, 404, post types and single posts), and render them into both classic and block themes without a page builder.
• Site parts can be listed, previewed with a resolver that explains which part wins for a given page and why, edited, activated or deactivated, and deleted, with every change to an existing part snapshotted and reversible.

• Custom block builder: updating a block, changing its status and deleting it now take a snapshot first and return an operation ID, so each change can be undone with rollback.

• New custom code tools: add CSS scoped to a single page or a single Elementor element, sanitized when written and again when rendered, with a snapshot per page so each change can be rolled back on its own.
• Optional site-wide custom JavaScript, off by default. It works only when the site owner opens the WPMCP_ALLOW_JS_INJECTION gate and the caller can post unfiltered HTML, and every attempt is audited.
• The stored custom code options can no longer be read or changed through the generic option tools.

• Code quality: the remaining discouraged-function calls (serialization, base64 storage encoding and the opt-in PHP snippet runner) are now justified in place, and the coding-standards baseline is lower.

• Bridged third-party abilities are now governed one by one: each is checked against the same governance toggles, identity scope and block rules as built-in abilities before it runs, and refused abilities are hidden from discovery and logged.
• Sites can narrow the ability bridge to specific abilities or namespaces with the WPMCP_ABILITY_BRIDGE_ALLOWLIST constant or the wpmcp_ability_bridge_allowlist filter. The target ability's own permission check always still runs.

• New in-admin AI chat (Pro): talk to your site from wp-admin using your own Anthropic API key, stored encrypted per user and never sent to the browser. Chat runs every tool through the same permission, governance, rate-limit and snapshot path as any MCP client, under its own scoped identity that admins can narrow.
• Any chat action that is not a pure read is shown as a proposal with its exact arguments and runs only after you approve it, with a single-use, server-verified approval bound to that call.
• The External services section discloses the chat's call to the Anthropic API, which happens only when an admin opts in and sends a message.

• New child theme scaffolding in the theme tools: create a child of the active theme with one confirmed call. It is off by default, never activates the child, and is fully reversible from the rollback history.
• New Astra settings in the theme tools: read and update Astra's core colors and content width when Astra is the active theme, with a snapshot before every change.
• Session rollback undoes a child theme scaffold only after reverting any theme switch made in the same session.

• Internal: each local test run now uses its own clean WordPress install, so parallel test runs no longer interfere with each other. No change to the plugin itself.

• New PHP snippet store: create, list, get, update and delete PHP snippets as stored, validated objects. Snippets are always created inactive, critical validation findings block creation, and every change is snapshotted and reversible. Activation is a separate, governed Pro operation that never executes code, and rollback always restores a snippet inactive.
• New theme tools: read the active theme's context (framework, parent and child, block theme support, menus) and write allowlisted theme mods with a snapshot for rollback. Theme writes are off by default.
• Elementor atomic elements follow Elementor 4.3's schema, and the Elementor version the test suite installs is pinned.
• Option names are matched the way the database matches them, so case, accent and invisible-character variants cannot reach a protected option.
• The full test suite now runs locally before every push, on WordPress 7.1 and the 6.9 minimum, with a coverage floor.

• Snapshot retention is now one flat number for every install (Snapshot_Store::DEFAULT_HISTORY_LIMIT, 20), raisable or lowerable for free through the new wpmcp_snapshot_history_limit filter (any whole number of 1 or more; anything else falls back to 20). The paid unlimited-history branch is gone.
• Upgrading sites keep the history they already have. If your snapshot table is deeper than 20, nothing is deleted until you either set the filter or use the "trim history" button in the admin notice.
• Pruning now deletes at most 200 snapshots per write, so a site with a deep history catches up over several writes instead of inside one request.
• Tested up to WordPress 7.1. The test suite runs on 7.1 and on the 6.9 minimum on every change.
• Only one WP MCP build boots per request: the full plugin, the wp.org build and the WooCommerce build rank themselves by a flavor header, and a lower-ranked copy stands down with an admin notice instead of colliding on shared constants.
• Translations load from the plugin's own languages/ directory (Domain Path header).
• New abilities: rewrite-site-urls (URL migration), restore-site-backup (with a dry-run compatibility gate), WooCommerce variation and stock tools, and an opt-in bridge for third-party abilities that honour show_in_rest.
• Change sets are derived from the snapshot ledger; caches are invalidated after rollback, raw database writes and term writes.
• The External services section names every outbound host.
• Dropped the third-party trademark from the tag list.

Install: download wpmcp.zip below and upload it in Plugins > Add New > Upload. Requires WordPress 6.9+ and PHP 8.1+. wpmcp-pro-0.8.1.zip is the self-hosted full build, wpmcp-for-woocommerce-0.8.1.zip the WooCommerce flavor.

First public release.

• 200+ abilities across content, builders, and integrations
• Snapshot before every write, one-click and session rollback
• Six-layer governance, audit log, scoped identities, OAuth 2.1
• Elementor, Gutenberg, Bricks, Divi, WooCommerce, ACF, Meta Box, and major SEO/forms/events integrations
• WP MCP Cloud sync client (Pro)

Install: download wpmcp.zip below and upload it in Plugins > Add New > Upload. Requires WordPress 6.9+ and PHP 8.1+.

Pro licenses: https://wpmcp-pro.com/pricing.html

Adds an opt-in (default-OFF) guarded PHP snippet runner for dev/staging, reviewed adversarially with a gate-bypass verdict of SHIP.

This is the one explicit escape hatch OUTSIDE the snapshot/rollback safety model: its effects are not captured and not undoable. The product's default promise holds because the tool is default-off, dev/staging-only, and admin-gated; it must be deliberately enabled.

Gates (each independently tested, and confirmed non-bypassable by review): default-off (WPMCP_ALLOW_PHP_EXEC, checked at call time on every path), environment fail-closed (only local/development/staging; production and unknown/empty refused unless a separate override), manage_options + governance + audit of every attempt (audit records outcome only, never the snippet source or output), a #22-validator pre-exec speed-bump (documented as anti-self-harm, not a security boundary), and bounded execution (output buffering, set_time_limit, catch Throwable). The evaluator is constructor-injected, never request-controlled.

+32 tests (1580 total). free/pro/lint green, safety core untouched.

Closes #45. This closes the final feature-parity issue.

Adds an opt-in (default-OFF) guarded WP-CLI runner, hardened across two adversarial security reviews.

Seven guards, each independently tested via an injectable executor (no test spawns a process): default-off (WPMCP_ALLOW_WP_CLI), production refusal (fails closed on unknown env), deny-by-default subcommand allowlist, no-OS-shell argv via proc_open array, no-PATH binary resolution, execution timeout with process-group kill, and full audit of every allowed/denied attempt.

Security note: the first review found a CRITICAL allowlist bypass (an allowlisted subcommand plus a wp-cli global flag such as --require/--exec/--ssh reached wp-cli and executed arbitrary PHP). Fixed before release with deny-by-default flag validation over the full token stream (only a narrow safe-flag allowlist like --format/--fields is permitted); the re-review confirmed the RCE is closed. option get / user list were removed from the safe defaults. Operators who widen the filterable flag allowlist can re-open this surface by design, so keep it narrow.

+91 tests since prior release (1548 total, 9 skipped). free/pro/lint green, safety core untouched.

Closes #44.

Adds an opt-in (default-OFF) OAuth 2.1 auth subsystem for remote MCP clients, hardened by an adversarial security review.

Implemented: RFC 8414 + RFC 9728 discovery metadata, RFC 7591 Dynamic Client Registration (rate-limited, 100-client cap, redirect_uri validation), authorization-code + PKCE with S256 mandatory (enforced at authorize and token time), SHA-256-hashed client secrets/codes/tokens, single-use 60s codes (atomic compare-and-swap), 1h tokens, audit-wired with no secret leakage.

Security review verdict was SHIP (0 critical/high). Fixed before release: tokens are now bound to credential state (get_userdata existence check + sha256(user_pass) fingerprint), so a stolen token dies on password change or account deletion; auth-code consumption is atomic against concurrent double-spend.

Scoped out (documented): consent-screen UI, refresh tokens, revocation endpoint, scope-to-ability enforcement. Accepted known-low: DCR rate-limit burst and unbounded metadata length (backstopped by the client cap).

+115 tests since prior release (1460 total). free/pro/lint green, safety core untouched.

Closes #43.

Adds Pro-tier support for Bricks and Divi alongside Elementor.

• Tools: detect-builder (classifies elementor/bricks/divi/classic/gutenberg), get-builder-content, update-builder-content.
• Bricks (_bricks_page_content_2 JSON meta) and Divi (post_content shortcodes + _et_pb_use_builder) writes route through Safe_Mutation, so they are fully undoable.
• +28 tests (1345 total); detect/get/update and byte-for-byte rollback for both builders are exercised in CI with no plugin installed (only the plugins' visual render is production-only). pro/free/lint green, safety core untouched.

Closes #47.

Adds free-tier read-only analytics via an adapter that prefers a connected Google Site Kit and falls back to configured credentials.

• Tools: get-analytics-connection-status, get-analytics-summary, get-top-pages, get-search-console-summary, get-search-console-queries. Date-range/limit validation; not-connected returns WP_Error, never fatal.
• +41 tests (1317 total). CI covers provider detection, validation, and normalizers against fixtures; live Google API round-trips are production-only and no test touches the network. free/pro/lint green, safety core untouched.

Closes #49.

Adds free-tier read-only network introspection, gated on is_multisite().

• Tools: is-multisite (always available), get-network-info, list-network-sites (paginated, capped), get-site-details (unknown blog_id -> WP_Error). Conditional registration mirrors the ACF/SEO/i18n pattern.
• Destructive fleet writes (create/delete/archive sites) are deliberately deferred: there is no whole-site snapshot model, so exposing them would break the nothing-unrecoverable promise.
• +21 tests (1276 total). CI covers the non-network paths, validation, normalizers and registration split; real network round-trips are production-only (harness is single-site). free/pro/lint green, safety core untouched.

Closes #35.

Adds free-tier access-control on top of the existing governance filters.

• Persisted per-ability/domain/operation toggles (wpmcp_governance option) composed as narrowing layers with the existing filters; any disable wins, stored enable can never force an ability back on.
• Scoped identities (wpmcp_identities): named identities with domain/operation/ability allowlists, enforced in the Registrar permission gate ANDed AFTER current_user_can() so identity scope can only narrow access, never escalate. Unknown identity = default-deny.
• Audit log records acting identity + ability + allow/deny outcome (capped, injectable clock).
• +53 tests (1255 total); the 8 original governance tests pass unmodified. free/pro/lint green, safety core untouched.

Closes #50.

Adds free-tier async backup job orchestration on top of the snapshot machinery, using WP-Cron as the executor and an option-backed job store.

• Tools: trigger-backup (queues job + schedules cron), get-backup-status, list-backup-jobs, cancel-backup-job (refuses non-queued).
• Deterministic incrementing job ids and injectable clock for stable tests; no randomness.
• +26 tests (1202 total), free/pro/lint all green, safety core untouched.

Closes #53.

Adds a Pro-tier generate-widget tool that builds valid Elementor widget elements (heading, text-editor, button, image) with real setting keys and inserts them into a post's _elementor_data via the undoable snapshot path.

• Deterministic element ids (crc32b of seed or element count), so generation is test-stable.
• +31 tests (1176 total), pro/free/lint all green, safety core untouched.
• Unknown widget type and missing required settings return WP_Error.

Closes #21.

Adds FREE-tier translation tools for Polylang/WPML via an adapter: list-languages, get-post-translations (read), set-post-language, link-post-translations (write, undoable via post snapshot).

• +23 tests (1145 total), lint clean, safety core untouched.
• Caveat: Polylang languages are not configurable in the PHPUnit harness (pll_* loads on plugins_loaded, before the harness requires the plugin), so live pll_* round-trips are exercised in production, not CI; wiring, adapter shape, validation, registration, and Safe_Mutation rollback are all tested. link-post-translations snapshots the primary post (documented limitation).

Closes #51.

Test hardening: 145 input-validation, functional-flow, and regression tests across the tool surface, locking in the fixed bugs (force-delete recovery, session rollback, SQL and filesystem guards, scanner self-DoS) and proving multi-tool undo flows. 1122 tests.

Harden page-audit SSRF: pin the validated public IP via CURLOPT_RESOLVE for the actual request, closing the DNS-rebinding window between validation and connect. 978 tests.

Onboarding tools: get-connection-info (MCP endpoint, Application Password steps, and ready-to-paste snippets for Claude Code, Cursor, Claude Desktop) and list-tool-catalog (all abilities grouped by domain with tier/operation/capability/hints). 973 tests.

HTML-to-blocks: convert-html-to-blocks maps HTML to core Gutenberg blocks (heading, paragraph, list, image, quote, code, separator, table), preserving unrecognized markup in a core/html block. Pairs with the safe-wrapped update-blocks to apply it. 964 tests.

Internal-linking analysis: find-orphan-posts, suggest-internal-links (ranked by shared taxonomy + keyword overlap), and get-link-map (incoming/outgoing counts, orphans, most-linked). Read-only. 953 tests.

wp.org plugin repository search: search-plugins (query the directory) and get-plugin-info (full plugin details by slug). Pairs with the existing install tools. 937 tests.

PHP snippet validator: validate-php-snippet statically checks syntax (token_get_all, never executes) and flags dangerous constructs (eval/exec/shell_exec, obfuscation, request-driven execution) with severities. 930 tests.

Pro-tier analysis: extract-content, analyze-seo (0-100 score, headings, links, alt coverage, Flesch readability), analyze-accessibility (WCAG scan with element locations), and check-contrast (WCAG AA/AAA). Read-only. 919 tests (96 Pro).

Content export/import: export-content (native WXR export to a protected dir), list-exports, and import-content (built-in WXR parser, disabled-by-default, confirm required, honestly not-undoable). Full file+DB site image is a tracked follow-up. 867 tests.

Shortcode and widget introspection: list-shortcodes, render-shortcode, list-sidebars, list-sidebar-widgets. 856 tests.

Block introspection: list-block-types, get-block-type, parse-blocks, and serialize-blocks (pure utilities over the block registry and parser). 847 tests.

Generic REST passthrough: list-rest-routes and call-rest, which performs an internal WP REST request so authorization is inherited from each endpoint's own permission callback. Writes are disabled-by-default, require confirm, and are honestly reported as not undoable. 829 tests.

Site context: get-site-context returns a single orientation payload (site info, WP/PHP versions, active theme, plugins, post types with counts, taxonomies, locale, active integrations, plugin/pro status). Read-only, no admin_email or secrets. 821 tests.

Maintenance mode: get-maintenance-status, enable-maintenance, and disable-maintenance (both undoable via the option snapshot). A 503 maintenance response is served to logged-out and non-admin visitors while admins keep full access, so you are never locked out. 810 tests.

WP-Cron tools: list-cron-events, schedule-event, unschedule-event (both undoable via the cron option snapshot), and run-event (opt-in, fires only currently-scheduled hooks with stored args). Core-critical hooks are protected from scheduling. 795 tests.

System diagnostics: get-debug-config, get-debug-log (bounded 64KB/200-line tail, path-confined), list-transients, delete-transient. 774 tests.

Generic post-meta and wp_options tools: get/set-post-meta (protected keys refused) and get/update-option (sensitive-option denylist, writes disabled-by-default). Meta and option writes are undoable via the snapshot engine. Media file-backup core change reviewed SAFE. 755 tests.

Force-deleted media is now fully recoverable: the file bytes (original and all sizes) are backed up before an irreversible delete and restored on rollback, and retention prune cleans the backups. This closes the last gap in the nothing-is-unrecoverable promise. 736 tests.

Comprehensive capability-gating tests across all 86 abilities and 17 domains, plus a security fix: get-settings and update-settings were gated at edit_posts and are now manage_options (matching WordPress core's own Settings gate). 724 tests.

SEO integration: get-seo-status, get-seo-meta, and update-seo-meta with a Yoast and RankMath adapter (neutral title/description/focus-keyword/canonical/robots mapped to the active plugin). SEO meta writes are undoable via the post snapshot. Harness now installs Yoast. 672 tests.

ACF (Advanced Custom Fields) tools: list-field-groups, get-fields, and update-fields (disabled-by-default). Field-value writes route through the post snapshot, so ACF changes are undoable. Test harness now also installs ACF. 650 tests.

Per-client rate limiting: a fixed-window limiter (default 120 requests / 60s, configurable) enforced around ability execution, so a runaway agent loop is throttled with a clear retry-after instead of hammering the site. Also de-flaked CI by stubbing plugin/theme update-check HTTP. 639 tests.

Pro-tier Elementor deep editing: get-elementor-data, add-widget, update-element, remove-element, move-element. Every edit routes through the post snapshot, so any Elementor change is one-click undoable, unique among WP MCP tools. First Pro-tier feature, exercised end to end. 625 tests (44 Pro).

Elementor widget catalog: list-widgets (registered widget types, category, Pro tier) and get-widget-schema (a widget's control params). Read-only, gated to active Elementor. 588 tests.

Cache management: get-cache-status (object cache, OPcache, and detected page-cache plugins) and clear-cache (flush object cache, transients, OPcache, and WP Rocket / W3TC / WP Super Cache / LiteSpeed / WP Fastest Cache via their own APIs). 578 tests.

Post revision tools: list, get, and restore a revision, with restore itself snapshot-safe and undoable. Also de-flaked the restore-ajax test by stubbing the version-check HTTP call. 562 tests.

Governance: per-ability, per-domain, and per-operation enable/disable toggles enforced at registration, plus readOnlyHint/destructiveHint/idempotentHint annotations on all 73 abilities. Audit log: filterable operation history (user, tool, domain, date) and a read-only admin screen with one-click restore of any agent mutation. Our snapshot/rollback + audit combination remains unmatched by competitors. 553 tests.

Harden the malware scanner: bound the webshell regex and add a mid-file deadline check (stops a crafted file from self-DoSing the scan), redact encoded-blob snippets so embedded secrets are not echoed, count all files toward the cap, and prune symlinked dirs escaping ABSPATH during descent. 504 tests.

Security/consistency hardening: force delete-post now gated (filter + confirm) like sibling deletes; history/restore admin raised to manage_options; update-rows requires confirm; read-tool capabilities tightened to their domain. 497 tests.

Read-only security scanner: malware heuristics (bounded, ReDoS-safe, path:line + capped snippet only), core-file integrity vs wordpress.org checksums, hardening audit, and outdated-software audit, with a 0-100 score and A-F grade. 490 tests green.

Navigation menu management: list/get menus and locations, create menu, add/update/remove items, assign to location, delete menu. Item edits and location assignment are snapshot-safe and undoable. 431 tests green.

WooCommerce store tools: products (CRUD), product categories, orders (list/get/update-status/add-note), and sales reports. Product edits and order-status changes are snapshot-safe and undoable via the rollback engine, which competing WP MCP tools do not offer. 402 tests green.

Test harness now installs and activates Elementor and WooCommerce, unblocking those parity areas. Skip helpers keep the suite green when a plugin is absent. 367 tests.

Comment moderation tools (list/get/moderate/edit/delete), all moderation writes snapshot-safe and undoable via a new comment object type in the rollback engine. 365 tests green.

Harden the page-audit SSRF surface: do not follow redirects (a 3xx is a finding), reject IPv4-mapped IPv6 loopback, honest docblocks. 338 tests green.

Feature-parity milestone: content, media, settings, users, plugin/theme, database, filesystem, and performance tools, all snapshot/rollback-safe where they mutate. 334 tests green. Adversarial reviews closed real bugs in force-delete, media, session rollback, the SQL guard, and the filesystem sandbox.