SudoWP Radar

SudoWP Radar is a runtime security auditor for the WordPress 6.9 Abilities API. It scans every registered ability across all active plugins and themes, applying a rule engine that detects the vulnerability patterns most likely to be exploited in production.

What it audits:

• Open and weak permissions — abilities with no permission_callback, or one that allows any authenticated user through.
• Missing or loose input schemas — abilities that accept unconstrained string inputs, creating potential injection vectors for path traversal, SSRF, and similar attacks.
• REST overexposure — abilities marked show_in_rest with no or open permission control, accessible to unauthenticated callers.
• MCP overexposure — abilities marked meta.mcp.public = true with a weak or null permission…