v1.30.0

Security release. Recommended for every site, and urgent on any site running Elementor's Angie.

Sites on 1.29.0 are offered this automatically through the self-updater, on the normal Plugins / Dashboard → Updates screens.

What was reachable

This plugin's write tools were callable from any other MCP server installed on the same site — a transport with no approval queue, no audit trail and no fleet visibility behind it.

Abilities are registered with WordPress, not with a server: wp_register_ability() publishes to a site-wide registry, so a second MCP server enumerates it and serves what it finds without asking anyone. Elementor's Angie 1.1.12 ships exactly such a server at /mcp/angie. Its discovery admits every third-party ability that does not declare a non-tool meta.mcp.type — which was every ability by default, this plugin's included — and its execute-ability proxy then runs them by name.

Read from Angie's source (Mcp_Adapter_Ability_Discovery, Mcp_Adapter_Ability_Permissions), not from its documentation.

Two guards, covering different sites

At registration, a write tool now declares meta.mcp.type = 'private'. Angie's listing and its execution gate consult the same value, so a type it does not serve removes the tool from the menu and from the door. This is the only protection on a site without SiteAgent, where the governance wrapper leaves every ability untouched.

At execution, a governed write arriving on any route other than this plugin's own MCP server must present a valid approval grant — whether or not grant enforcement is switched on. The refusal lands before the tool runs, so an unauthorized create cannot insert a draft and then be rolled back. A valid grant still passes: a grant is gateway context, bound to the exact tool and params, whatever route carries it.

Read tools stay available to other servers on purpose. An assistant answering "what is on this page" from this plugin's data is the entire point of the read-only bridge. Only writes are withheld.

Escape hatches

Both off by default:

• elementor_mcp_expose_writes_to_foreign_mcp — re-expose write tools to other MCP servers.
• elementor_mcp_trusted_write_context — trust a named REST route, for an operator with a genuine second integration.

Diagnostics

server-info now reports write exposure: whether writes are withheld, which write tools (if any) are left open and why, whether the execution-side check is actually running (it needs SiteAgent — a fork-only site is protected by the registration metadata alone, and the report says so), and which other MCP servers are active on the site, including which of them publish these tools directly.

Verification

Every governed family — page data, kit design tokens, global classes — is exercised end-to-end from a foreign transport carrying a valid grant, confirming the snapshot and render check still fire. 1117 tests.

Full detail in CHANGELOG.md.