Aculect AI Companion

Aculect AI Companion has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 7.3 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Open Redirect, behind 1 of the records (100%).

The one issue recorded for Aculect AI Companion has a vendor fix available, so running the current release closes it.

All of these findings were reported by Ananda Dhakal. Aculect AI Companion is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
7.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Aculect AI Companion vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.3CVE-2026-39600

Aculect AI Companion <= 0.8.2 - Missing Authorization to Unauthorized Redirects

Read the full analysis

Vulnerability Records

1 records
Aculect AI Companion banner
Latestv0.8.3

Aculect AI Companion

Mehul Gohil

Author

Mehul Gohil

0.0(0)
0/100
Last Updated
2026-10-12 (7d ago)
Active Installs
10+
Downloads
1,312
Requires WP
6.5+
Requires PHP
8.2+
Tested up to
WP 7.1.3
Created
2026-05-22 (5mo ago)

Aculect AI Companion is a secure MCP connector for WordPress. It lets approved AI apps such as ChatGPT, Claude, Grok, and other compatible clients work with your WordPress content, media, comments, and site information through permission-aware workflows. Instead of switching between WordPress admin screens, you can ask your AI assistant in plain English to draft a post, update a page, review comments, upload media, inspect safe site details, or prepare long-form content using WordPress blocks. WordPress remains the source of truth. Aculect AI Companion checks the connected WordPress user’s permissions before every action, lets administrators choose which optional abilities are available, keeps safe baseline read/discovery abilities default-active, and keeps risky write actions behind configurable controls. What is MCP for WordPress? MCP stands for Model Context Protocol. In Aculect AI Companion, MCP gives supported AI assistants a structured, permission-controlled way to request WordPress actions. The assistant does not receive direct database access. It can only use the enabled tools exposed by WordPress and approved by an administrator. Why use Aculect AI Companion? Connect WordPress to ChatGPT, Claude, Grok, and other MCP-compatible AI apps Offer one bounded, read-only WebMCP page-context tool on public pages in compatible browsers without exposing backend management abilities Create, update, and organize WordPress content through controlled AI workflows Audit internal linking, review link opportunities, and apply approved suggestions through MCP Work with posts, pages, custom post types, categories, tags, comments, and media Use block-aware content workflows instead of raw custom HTML Inspect Site Editor and admin menu surfaces before planning theme or settings work Review AI activity with sanitized audit logs Control access globally, by connection, by role, and by WordPress user permissions Use diagnostics to verify OAuth, MCP, endpoint, and environment readiness Setup is designed to be simple: Copy your connection URL from AI Companion > Connect. Choose ChatGPT, Claude, Grok, or another AI app for the right setup guide. Paste the URL when prompted by your AI app. Approve the connection on the screen that appears. After approval, Aculect AI Companion checks the connected WordPress user’s permissions before every action. You can also choose exactly what your AI assistant can do and disconnect assistants at any time. Provider-specific setup notes ChatGPT custom apps use an approved snapshot of MCP tools. After an Aculect ability or schema change, refresh the app actions in ChatGPT workspace settings; Business apps may need to be recreated and republished. Claude API integrations should use the mcp-client-2025-11-20 beta header and reference Aculect from exactly one mcp_toolset. Use tool allowlisting and defer_loading to reduce initial context. Anthropic documents that the MCP connector is not eligible for Zero Data Retention. Cursor remote MCP setup uses the connection URL with the url key. When fixed OAuth registration is required, use https://www.cursor.com/agents/mcp/oauth/callback for web and Cursor Agents or http://localhost:8787/callback for the desktop app. Toggle the MCP server off and on after ability changes to refresh tool metadata. Features Create, edit, and publish posts, pages, and supported custom post types Plan and draft long-form block content for WordPress Audit internal linking, prepare reviewable link suggestions, and apply approved links through MCP Manage categories, tags, custom taxonomies, and content groups Moderate, reply to, and bulk-manage comments Upload, list, update, attach, detach, and safely rename media View safe site settings, active plugins, active themes, and diagnostics Connect, pause, review, and disconnect AI assistants Control which MCP abilities each assistant can use Supported AI Tools Aculect AI Companion keeps the primary setup surface focused on: ChatGPT custom apps. Developer Mode availability depends on your plan and workspace settings. Claude custom connectors through Customize > Connectors. Grok custom MCP connectors through https://grok.com/connectors. Grok must be able to reach your WordPress MCP endpoint over public HTTPS. Cursor remote MCP servers. Standards-compatible remote MCP clients. Your AI tool must be able to reach your WordPress site over HTTPS to complete OAuth approval and send MCP requests. Supported Abilities Admins can enable or disable optional abilities from AI Companion > Abilities after the first assistant connection is active. Baseline read/discovery abilities for core MCP guidance remain default-active and are not individually disableable, but WordPress capabilities, OAuth scopes, connection access, and execution-time policy checks still apply. Long-form content workflows: Prepare a post outline, section plan, taxonomy recommendations, media recommendations, and SEO recommendations Create a draft from validated serialized WordPress block content Update an existing post with block-safe content workflows Update Rank Math SEO title, description, and focus keywords when Rank Math is active Inspect recent Rank Math 404 Monitor entries and prepare safe Rank Math redirects when those modules are active Content: List readable content types, including custom post types List posts, pages, and custom content items with pagination Read one content item by ID Create a post, page, or custom content item with optional featured image, author, and taxonomy assignments Update title, content, excerpt, slug, status, featured image, author, or taxonomy assignments for an existing item Update SEO title, SEO description, and focus keywords for supported SEO plugins Internal linking with MCP: Audit supported content for internal-link gaps and discover relevant on-site content Map potential linking opportunities and prepare reviewable suggestions Review individual suggestions before applying them to supported content Apply approved suggestions only when the connected user’s WordPress permissions and configured MCP policy allow the change Aculect AI Companion keeps internal linking in the MCP content workflow instead of a separate Internal Links admin tab. It does not add links automatically when the plugin is activated or when an AI assistant connects. Redirects and 404 workflows: List bounded Rank Math redirection rules when Rank Math Redirections is active Validate proposed Rank Math redirects before saving them Create one or more Rank Math redirects with per-item results and dry-run support Review recent Rank Math 404 Monitor entries with query strings redacted Content groups: List available categories, tags, and custom content groups List terms for a supported taxonomy with pagination Create a category, tag, or custom content group Update a category, tag, or custom content group Assign or clear existing categories, tags, or custom taxonomy terms on a content item Assign or clear an image for supported taxonomy terms Comments: List comments for review with pagination Read one comment by ID Reply to a comment as the connected WordPress user Moderate comment content or status Bulk moderate multiple comments Media: List media library attachments with pagination Read, update, trash, and safely rename media items Upload media from a public URL with server-side request checks Attach media to posts or detach media from posts Site information: View safe, non-secret site settings View WordPress version, PHP version, active theme, and basic site metadata List installed plugins and active state for users who can manage plugins List installed themes and active state for users who can manage themes WordPress abilities: Discover supported public WordPress abilities registered by WordPress and plugins Inspect one supported public WordPress ability Run a supported public WordPress ability using the connected user’s permissions Third Party Services Aculect AI Companion does not send site data to an external service on activation, page load, cron, or without a site administrator connecting an AI assistant. When a site administrator copies the connection URL into an external AI assistant and approves the connection screen in WordPress, that assistant can request the enabled abilities. Depending on the enabled abilities and the connected WordPress user’s permissions, requested data may include post titles, post content, excerpts, slugs, statuses, authors, dates, permalinks, category and tag names, media metadata, comments, and safe site settings such as site name, description, URLs, locale, timezone, date format, time format, permalink structure, and active theme name. The external service that receives this data is the AI assistant selected and configured by the administrator. Aculect AI Companion’s built-in setup UI includes links for: ChatGPT by OpenAI: https://chatgpt.com/, terms at https://openai.com/policies/terms-of-use/, and privacy policy at https://openai.com/policies/row-privacy-policy/ Claude by Anthropic: https://claude.ai/, terms at https://www.anthropic.com/legal/consumer-terms, and privacy policy at https://www.anthropic.com/legal/privacy Cursor by Anysphere: https://cursor.com/, terms at https://cursor.com/terms-of-service, and privacy policy at https://cursor.com/privacy Gemini by Google: https://gemini.google.com/, terms at https://policies.google.com/terms, and privacy policy at https://policies.google.com/privacy Grok by xAI: https://grok.com/, terms at https://x.ai/legal/terms-of-service, and privacy policy at https://x.ai/legal/privacy-policy Administrators should review the terms and privacy policy for the AI assistant they connect. Aculect AI Companion controls the WordPress-side approval and permissions checks; it does not control how a connected external assistant processes data after the administrator authorizes access. Development The production package ships built assets and Composer dependencies. Development manifests such as composer.json, composer.lock, and package.json are intentionally excluded from release ZIP files. Generated files under build/ are not committed to the source repository; release automation generates them before packaging. For source code, build tooling, and exact dependency manifests, use the public GitHub repository: https://github.com/mehul0810/aculect-ai-companion Contributing guidelines: https://github.com/mehul0810/aculect-ai-companion/blob/main/CONTRIBUTING.md Security policy: https://github.com/mehul0810/aculect-ai-companion/security/policy From the repository checkout, use the Node.js version in .nvmrc and rebuild assets with: npm ci npm run build Composer dependencies for production releases are installed with: composer install --no-dev --prefer-dist --optimize-autoloader

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C