v1.5.4 — Fix OAuth consent for logged-in admins

Update via the auto-updater on your Plugins page (Dashboard → Updates → "Update Now") — no need to download/upload manually.

Fix

The OAuth consent endpoint lives at /wp-json/claude-mcp/v1/oauth/authorize — i.e. inside the WP REST API. WordPress's REST routes only honor cookie-based auth when the request carries an X-WP-Nonce header. A top-level browser navigation to that URL does NOT include such a nonce, so is_user_logged_in() returned false even for logged-in admins, and the flow bounced back to wp-login.php.

OAuth::rest_authorize_get and rest_authorize_post now manually call wp_validate_auth_cookie('', 'logged_in') to set the current WP user from the browser cookie when the REST auth chain didn't. The cookie is HMAC-signed by WordPress, so this is full verification — not an auth bypass.

After updating

Open the OAuth consent URL in the same browser where you're logged in to WP admin → you'll go straight to the consent screen (no login bounce) → click Approve → MCP server tools come online.