Skip to content

WPPilot 1.1.0

Choose a tag to compare

View all tags
@wppilot-labs wppilot-labs released this 12 Aug 20:43
· 74 commits to main since this release
v1.1.0
50ff044
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The WordPress core surface now ships in the free plugin, and both MCP protocol revisions are served during the migration window.

Install: download wppilot-1.1.0.zip below — not GitHub's "Source code (zip)", which unpacks to the wrong folder name and will not install.

Highlights

  • 92 abilities, up from 42. Content, taxonomies, media, comments, revisions, menus, privacy-minimized user reads and an allowlisted settings surface all work with Free alone — no licence, entitlement service or Pro install.
  • Draft-first. New content is created as a draft unless publication is requested explicitly. An absent, blank or malformed status resolves to draft before any capability check.
  • Real capability enforcement. Capabilities come from each post type's and taxonomy's own capability object, so a custom type declaring its own set is enforced on its own terms. Publishing is checked separately from editing.
  • MCP 2026-07-28 alongside 2025-11-25. The new revision is stateless — no handshake, no session. Existing clients are unaffected and do not need to reconnect.
  • Client ID Metadata Documents are now the preferred OAuth registration mechanism, with Dynamic Client Registration kept as a fallback.
  • Connect screen leads with authentication. Devin Desktop (formerly Windsurf), Factory Droid, the Codex desktop app, OpenClaw and Manus are recognised.

Security and privacy fixes

  • Content create, update and delete previously ran on a single administrator check and ignored post-type capabilities and post ownership. Both are now enforced.
  • Menu item URLs are validated before storage. A javascript: or data: URL was previously stored verbatim and rendered into a link.
  • User reads no longer return email addresses by default. Login name, roles and registration date require the capability to list users; the email address requires the capability to edit them.
  • Comment listings withhold commenter email and IP from accounts that cannot moderate comments.
  • Packaging: the WordPress.org build was shipping a plugin that fatals on load, caused by a line-delete that removed a guard clause and orphaned its brace. Both builds are now parsed before they are archived.

Upgrading

Your AI client will see roughly twice as many tools after updating. Existing connections keep working and do not need to be re-authorised.

Full detail in CHANGELOG.txt.

Assets 3
Loading