v1.5.1

Security hardening & self-updater

Security

• upload-media SSRF hardening — validate URL scheme, resolve DNS, block RFC 1918/loopback/link-local/metadata targets
• audit-post per-post permission check — prevents auditing another users unpublished content
• audit-post link checker — re-enabled TLS verification, restricted to editor+ role, scheme-validated
• transition-status — enforces post-type-specific publish capability after loading the post

Improvements

• Audit log now records the real MCP ability name and distinguishes MCP-driven vs wp-admin changes
• Self-updater — plugin checks GitHub releases for updates; use Dashboard > Updates > Check again for manual checks

Fixes

• Version metadata in plugin header and readme.txt now matches actual release
• WPCS alignment fix for consecutive assignment equals signs