IATO MCP

IATO MCP has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for IATO MCP has a vendor fix available, so running the current release closes it.

All of these findings were reported by Ananda Dhakal. IATO MCP is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all IATO MCP vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2026-32582

IATO MCP <= 1.12.0 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
IATO MCP banner
Latestv1.14.0

IATO MCP

iatoai

Author

iatoai

0.0(0)
0/100
Last Updated
2026-10-16 (4d ago)
Active Installs
100+
Downloads
3,676
Requires WP
6.2+
Requires PHP
8.0+
Tested up to
WP 7.1.3
Created
2026-04-24 (6mo ago)

WordPress.com has a built-in MCP server. Now self-hosted WordPress does too. IATO MCP connects your WordPress site to Claude Desktop and other MCP-enabled AI clients. Once connected, you can ask Claude to audit your site and fix SEO issues, identify orphan pages, clean up broken links, and more, all in a single conversation. How it works Install and activate the plugin Follow the setup wizard — copy the config into Claude Desktop, or use “Add Custom Connector” with your site URL Connect your IATO account for AI-powered analysis (free trial up to 500 pages) What Claude can do Without an IATO account (45 WordPress tools): Read and edit posts, pages, and media Create new posts and pages with excerpt support Update SEO titles and meta descriptions (Yoast SEO, RankMath, SEOPress) Update canonical URLs Update image alt text Upload new images to the media library (base64 by default; URL ingestion optional with admin allowlist + full SSRF protection) Set and clear the featured image on any post Read and write arbitrary post meta with a credential-key denylist and a known-safe theme/builder/SEO allowlist (force=true required outside the allowlist) Set per-post theme + builder page settings (hide title, sidebar layout, content layout, etc.) on Astra, Kadence, GeneratePress, and Elementor in one call Read and edit navigation menus Manage categories, tags, and taxonomy terms Manage JSON-LD structured data Manage redirect rules Read and write Elementor page builder data Widget-grained Elementor edits with optimistic concurrency, idempotency, and bulk operations Fix heading levels, text, links and image alt text on Elementor Atomic Editor (V4) elements (Elementor 4.3.0 or later), converted and validated with Elementor’s own code, each change with its own rollback Clone the styling of an existing Elementor post in one call via update_elementor_data(..., inherit_settings_from: <id>) Resolve URLs to their rendering post (Theme Builder shadowing detection) Search content across the site Read site info and settings Read and filter comments One-call rollback for any tracked write — every change emits a receipt with a stable change_id; pass it back to the rollback tool and the original value is restored With an IATO account (12 bridge tools — full analyze-and-fix pipeline): Start a new crawl of your site directly from Claude (admin only) Check crawl status and list recent crawl jobs Run a full SEO audit and fix title, meta description, and alt text issues automatically Identify orphan pages not linked from any navigation menu Audit navigation menus for gaps and missing sections Surface thin content with specific improvement recommendations Map broken links to source posts for direct editing Analyze site taxonomy and suggest consolidations Get AI-prioritized suggestions across all areas Flag slow pages with contributing performance factors Supported SEO plugins Yoast SEO RankMath SEOPress Falls back to native WordPress title if none detected Example prompts “Crawl my site and fix all missing meta descriptions” “Show me pages that aren’t in any navigation menu and add them to the right place” “What are the most impactful improvements I can make to my site right now?” “Find all broken links and tell me which posts contain them” “Audit my categories and tags and suggest consolidations” “Set every H2 heading in these Elementor posts to H1” “Find all button widgets on the site and change their color to #ff0000” External Services This plugin connects to the following external service when configured: IATO API (https://iato.ai) — When you enter an IATO API key in the plugin settings, the plugin sends requests to https://iato.ai/api to retrieve crawl data, SEO audit results, sitemap information, and AI-generated improvement suggestions. No data is sent to IATO until you configure an API key. Your public page URLs (as crawled by IATO) and crawl analysis results are transmitted. IATO Terms of Service IATO Privacy Policy The plugin also implements an OAuth 2.0 authorization server on your WordPress site so that MCP clients like Claude Desktop can authenticate via the standard “Add Custom Connector” flow. This communication stays between the MCP client and your WordPress site — no data is sent to third parties during authentication.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C