MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 3 are fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10. 2026 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.
Every one of the 3 issues recorded for MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Raphael P. Cigana. MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-96525MCP Server for WordPress <= 1.8.1 - Missing Authorization
Read the full analysisVulnerability Records

MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
Author
Azizul Hasan
AtlasMCP is the only WordPress MCP server with no limit on how many AI abilities your site can expose. It turns your site into a Model Context Protocol (MCP) server so AI assistants and autonomous AI agents like Claude, ChatGPT, Gemini, Cursor, and Claude Desktop can read, write, and manage your posts, pages, media, users, settings, and WooCommerce store through natural language. Your tool list is not a fixed catalogue: on top of the built-in abilities, the free plugin picks up every ability any plugin registers through the WordPress Abilities API and turns WooCommerce’s own REST API into read-only AI tools, with no cap in free or Pro. Generate excerpts, feature images, summaries, titles, and alt text without leaving the post — on a secure MCP server built around OAuth 2.1 with PKCE, per-role access control, and an audit trail of every AI action, so each connection only does what you allow and nothing happens on your site unseen. How do I connect Claude, ChatGPT or Gemini to WordPress? A setup guide walks a new site from install to “my AI app answered a question”: what you want AI to do, a check of your site, which tools to offer, connecting your app and a first question. Any time later, open AtlasMCP → Connections and click Connect an AI app: Claude opens with your site already filled in, Cursor and VS Code add it in one click, and ChatGPT, Claude Code and Gemini CLI get short steps. You approve on your own site, choosing Full access or Read only, and the screen tells you the moment the app is connected. No tokens to copy. Scripts and automation tools can use an access token or an Application Password instead. Does it work with my other plugins? Yes. Most MCP plugins only expose what they wrote themselves; AtlasMCP turns the plugins you already run into AI tools: Abilities API — free, unlimited. Any plugin that registers abilities through the WordPress Abilities API is picked up automatically. REST API to AI tools — WooCommerce free, every plugin in Pro. AtlasMCP reads REST endpoint definitions and turns them into AI tools, grading each one on how well it describes itself. WooCommerce AI agent Turn Claude or ChatGPT into a WooCommerce AI agent. The free AI Store Manager module adds 24 store tools: search and edit products, categories, tags and brands, look up orders, and read sales reports. WooCommerce’s own REST API adds read-only tools for products, orders and customers, so an AI can answer “which products are low on stock”. Pro adds the rest of the REST API — fulfil orders, issue refunds, edit customers, coupons, shipping and more — and each role only gets the tools you grant it. Is an MCP server on WordPress secure? An MCP server gives an AI assistant real write access, so this one is built to be governed, not trusted blindly: OAuth 2.1 with PKCE and dynamic client registration — your site is its own authorization server, with no client secrets or long-lived tokens to leak. JWT and Application Passwords work for headless and CI use. Every connection maps to a WordPress user — an AI client can never exceed what the person behind it may do. Role-based access control — choose which modules and abilities each role may use. Pro adds per-ability RBAC, tool/resource/prompt modes and OAuth scope rules. Audit trail — with the official AI plugin’s request logging on, every AI tool call is recorded: tool, user, duration and result. Read-only apps, a pause switch and one-click revoke — the Connections screen lists every AI app, token and app password, who it acts as and when it was last used. Your keys, your server — bring your own AI provider keys; nothing is proxied through us. Works with the official WordPress AI plugin and the Classic Editor AtlasMCP integrates with the official AI plugin instead of running a parallel system: our AI experiments appear as feature cards on its Settings → AI screen, respect its toggles and inherit its editorial Guidelines, and you can hide its duplicate experiments. All experiments also work in the Classic Editor, which the official AI plugin does not support. Why choose AtlasMCP? MCP server + AI content in one plugin — most WordPress MCP plugins do one or the other. Works on WordPress 6.8+ — bundles the Abilities API and MCP Adapter, so you need not wait for core. Multi-provider AI — OpenAI, Google Gemini or Anthropic Claude through the WordPress AI Client; one provider key serves everything. Workflow builder — combine abilities into reusable workflows. Modules — individually toggleable AI Content Steward (22 abilities) — content analysis and generation, plus posts, categories and tags. Abilities from other plugins — other plugins’ REST endpoints as tools. Pages Manager (5), Media Manager (7), Users Manager (7), Custom Post Types Manager (6). REST API Tools (3) — discover and run any WordPress REST endpoint. Site Info & Diagnostics (4) and Settings Manager (3). AI Store Manager — WooCommerce (24) — requires WooCommerce. Error Debugger (4) — PHP error monitoring with AI fix commands. External Abilities — every ability other plugins register through the Abilities API. AI Content Generator: Write Blog Posts, Pages and Product Descriptions Six panels run on your AI provider in both the Block Editor and the Classic Editor: Content Generation — an AI blog post generator and article writer: pick a title, edit the outline, then generate and preview the full post. Works for pages, custom post types and WooCommerce product descriptions. Excerpts, Title Suggestions and Summaries — one click, with tone and style presets. Feature Image Generation — images generated from your post content. Alt Text Generation — vision-based: the AI sees the actual image, not just the filename. Pro extends every experiment with a prompt templates library, batch variants, generation history, model tuning, “Explain This Generation” and keyboard shortcuts, and lets Content Generation link to posts and products that really exist. Shopping assistant: customers shop with their own AI (Pro) A “Shop with AI” button lets shoppers connect Claude, ChatGPT or another AI app in a few taps. Their assistant searches your catalogue, builds the cart and places the order, as a guest or with their account. It can never edit your store, and card payment always finishes on your own checkout page. Site check, Versions and Error Debugger Connection health check — checks HTTPS, permalinks, the login header, security plugins, page caches and whether the internet can reach your site, says what to fix, and can add the missing login-header line to .htaccess for you (after a backup). Versions — go back to an earlier release in one click; each version is checked against your site first, and your settings and connected apps are kept. Error Debugger — PHP errors from plugins and themes, grouped by file, with email alerts and a copy-paste Fix Command for any AI assistant. Pro adds an MCP Fix Command with automatic backups, Slack/Discord webhooks and a Backups Manager. See every AI tool on your site, and fix the weak ones The Abilities screen lists every tool your site can expose — ours, other plugins’, and those derived from REST endpoints — and grades each one on how well it describes itself, with a tool budget so AI apps stay accurate. The Usage screen shows what was actually called. Pro adds an editor for any ability’s name and description, saved as an overlay so plugin updates never overwrite it. Built on the WordPress AI building blocks Every ability is registered through the standard WordPress Abilities API and exposed over MCP via the official MCP Adapter, both bundled so everything works on WordPress 6.8+ today. Add your provider key once under Settings → Connectors with the official AI Provider for OpenAI, Google or Anthropic plugins, and AtlasMCP reuses it. Role-based MCP access and OAuth Your site is its own OAuth 2.1 server: an AI app finds it through .well-known metadata, registers itself and completes a PKCE sign-in after you approve. The connection acts as your WordPress user, so your role and Access Control decide what it can do. Pick a role, check the abilities and workflows it may use, and save; changes apply to every connection at once. New tools go to Administrator automatically, and by default only users who can edit posts may approve a connection (awfah_oauth_authorize_min_capability filter). AtlasMCP Pro AtlasMCP Pro adds the Shopping assistant, unlimited workflows (free allows 3), per-ability RBAC with per-role OAuth policy, T/R/P access modes, ability editing, REST tools for every plugin, including writes, advanced AI experiments, workflow prompt builders, Error Debugger Pro and priority support. 7-day free trial, no credit card required. External services AtlasMCP connects to the outside services below only for the features named. Nothing else leaves your site, and the MCP server itself does not send your content anywhere: the AI apps you connect call your site, not the other way round. AtlasMCP connection check (AtlasAiDev) When you press Run check on the Connections screen, the last step asks an AtlasAiDev server at voice.atlasvoice.cloud to call your site from the internet, the way Claude and ChatGPT do. It sends your site address and your MCP server address, nothing else. The server then reads only your site’s public sign-in addresses; it never signs in or changes anything, and it keeps no record beyond a short technical log. It runs only when you press the button, and it is skipped for local sites. Terms, Privacy policy. Developers can point it elsewhere or switch it off with the awfah_reachability_endpoint filter. WordPress.org The Versions screen asks the WordPress.org plugin directory (api.wordpress.org) for this plugin’s released versions when you open it, and downloads a version from downloads.wordpress.org only when you press Roll back. The Our Plugins page reads the public ratings of our plugins from api.wordpress.org. Only the plugin names are sent. Privacy policy. GitHub (raw.githubusercontent.com) The Our Plugins page and the dashboard’s occasional offers read two public JSON files we publish on GitHub, cached for 12 hours. The request is a plain download; no information about your site is sent. Terms, Privacy policy. Usage tracking (AtlasAiDev, opt-in) Only if an administrator clicks Allow on the opt-in notice or ticks Share anonymous usage data in the setup guide, the plugin sends track.atlasaidev.com the site name, language and address, the administrator’s name and email, the number of plugins, which AtlasMCP modules are on, and feature-usage counts. Never post content, credentials or tokens. You can opt out at any time. Terms, Privacy policy. Your AI provider (OpenAI, Google or Anthropic) The AI experiments (content, excerpts, titles, summaries, featured images, alt text) send the text or image you are working on to the AI provider you set up under Settings → Connectors, through WordPress’s AI Client, only when you press a generate button. Generated images are then downloaded from the provider into your Media Library. The provider’s own terms apply: OpenAI (Terms, Privacy), Google (Terms, Privacy), Anthropic (Terms, Privacy).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C