GoBuildWP 1.18.6 — WPPilot is now GoBuildWP, plus two security fixes

WPPilot is now GoBuildWP. Same plugin, same wppilot folder, settings, connections, change log and Pro licences. Existing installs update in place and keep working.

Download gobuildwp.zip below and install it with Plugins → Add New → Upload Plugin. It installs as wp-content/plugins/wppilot. Do not use GitHub's "Source code" archive. (wppilot.zip is the same file under its old name, kept for older links.)

Changed

• Rebrand to GoBuildWP. Update checks (and telemetry, when switched on) use gobuildwp.com; new GoBuildWP Cloud connections use app.gobuildwp.com. Sites already connected to Cloud keep their connection.
• New client setups suggest the server name gobuildwp-<your-site>; existing client configurations keep working.
• Ability descriptions an AI client reads now state what the code does, including which changes can be undone and the limits of safe-update rollback.

Security

• The MCP endpoints on the bundled MCP Adapter (/wp-json/mcp/wppilot, the OAuth endpoint and the legacy alias) admitted any signed-in user for the legacy protocol: a subscriber with an Application Password could list tools and read skill resources (running abilities was already refused). They now require AI abilities switched on and GoBuildWP's manage capability, as the modern protocol, OAuth and REST already did.
• The PHP sandbox treated only .php as PHP; .phtml, .phar, .php7, .pht, .phps and similar could be written outside wp-content/wppilot-sandbox/. Every extension a server may run as PHP now has to stay in the sandbox.

Fixed

• OAuth clients speaking MCP 2026-07-28 on /wp-json/mcp/wppilot-oauth got "Missing Mcp-Session-Id"; the modern protocol is now served there.
• WordPress 7.1 core public abilities are now published on both protocols.
• A missing bundled vendor directory now stops OAuth with a clear notice instead of a fatal error.

Requires WordPress 6.9+ and PHP 8.0+, tested up to 7.1. GoBuildWP Pro 1.12.4 requires Free 1.18.1 or newer.