Enable Abilities for MCP · Version history
Enable Abilities for MCP changelog and version history
- Latest version
- 2.15.0
- Nov 6, 2026 (3 days ago)
- Releases
- 62
- since 2026
- In the last year
- 62
- about one every 4 days
- Tested up to
- WordPress 7.1.4
- PHP 8.0 or later
202662 releases
Enable Abilities for MCP 2.15.0Latest
- New: ewpa/create-post accepts meta, an object of custom fields written in the same request that creates the post. An agent that tags each post with its own run ID can now find, after a timeout or a retry, the post an earlier attempt already created, instead of publishing it twice. Protected keys (t…
- New: ewpa/get-posts filters by custom field with meta_key, and optionally meta_value for an exact match. Filtering needs an editing capability, since it reveals which posts carry a value; protected keys need an administrator. meta_value on its own is refused rather than ignored. Drafts by other aut…
Enable Abilities for MCP 2.14.0
- Fixed: the four WooCommerce read abilities asked for a capability to edit instead of one to read, so a user whose role was built to read orders and products and nothing else was refused. ewpa/wc-get-orders and ewpa/wc-get-order now ask for read_private_shop_orders, and ewpa/wc-get-products and ewpa…
- New: the ewpa_ability_capability filter changes the capability an ability requires, as ( $capability, $ability ). It is currently routed through those four WooCommerce abilities, so a read-only role can be given exactly the access it needs. It tightens as readily as it loosens, and when it is used…
- New: a Settings link in the plugin’s row on the Plugins screen. The settings page lives under Settings rather than in its own top-level menu, which made it easy to lose. A Donate link sits on the description line, beside “View details”.
Enable Abilities for MCP 2.13.7
- Security: the Bearer token could be used against the whole WordPress REST API, not only this plugin’s MCP routes. The check that limited it read the request URL, but WordPress decides which route to run from the rest_route query variable, and that variable wins over the URL. A request could therefo…
- Fixed: the Bearer token now works on sites that do not use pretty permalinks. The old check looked for /wp-json/ in the URL, which those sites never send, so the token was always refused there.
- New: the ewpa_bearer_route_prefixes filter adds REST route prefixes the Bearer token is accepted on, for sites that run a second MCP server — JetEngine 3.9 ships its own. It is a filter and not a setting on purpose: the token carries administrator rights, so every prefix added is driven as an admin…
Enable Abilities for MCP 2.13.6
- Fixed: ten abilities were switched back on by themselves on every page load, so turning any of them off never lasted beyond the next request. Seven of the migrations that add abilities to existing installs never recorded that they had run, unlike every other migration in the plugin, so they ran aga…
Enable Abilities for MCP 2.13.5
- Updated: the bundled wp-media/mcp-oauth library goes from 1.0.3 to 2.0. Other plugins ship their own copy of the same library — Imagify carries a newer one — and since every Composer autoloader involved registers itself first, whichever plugin loads last wins for the whole site. Shipping the oldest…
- Updated: composer.lock is now part of the repository, so the packaged library versions are reproducible instead of depending on the machine that builds the release.
Enable Abilities for MCP 2.13.4
- Fixed: the “requires the MCP Adapter plugin to work” notice appeared on sites where MCP Adapter was installed and active. Since its 0.7.0 release the adapter refuses to start when another plugin has already registered its own bundled copy of WP\MCP\Core\McpAdapter, and it then never defines WP_MCP_…
Enable Abilities for MCP 2.13.3
- Security: object-level authorization across every ability that reads or writes a post. A capability was checked site-wide (edit_posts, read, edit_products) but never against the specific post, so a Contributor could duplicate another author’s draft and publish it keeping the original author, publis…
- Security: student records (ewpa/tutor-get-user-progress, ewpa/tutor-get-quiz-results) require edit_users, matching their LearnDash equivalents, instead of edit_posts. The SEO readers (Rank Math, SEOPress, Yoast), ewpa/tec-get-event, ewpa/ld-get-course and ewpa/get-accessibility-snapshot now check t…
- Security: ewpa/upload-image checks edit_post on the parent before attaching an image or setting a featured image.
- Security: protected meta keys (leading underscore) require edit_post on the target plus either manage_options or an explicit register_post_meta() / auth_post_meta_{key} authorization. Writing SEO keys such as _genesis_title keeps working for administrators; ewpa/get-cpt-item no longer returns prote…
- Security: creating a term by name requires the taxonomy’s edit_terms capability, in ewpa/assign-post-terms, ewpa/assign-cpt-terms and the taxonomies field of the CPT abilities.
- Fixed: ewpa/get-posts and ewpa/get-pages no longer emit “Undefined array key” notices for status, orderby and order, which disclosed the server path on any site rendering PHP notices.
- Fixed: a disabled third-party ability could silently re-enable itself when its plugin happened to be inactive while the settings page rendered, because the denylist was recalculated from whatever that page offered.
- Behavior change: asking for publish, future or private without the publish capability of that post type now returns a forbidden error, which is what the WordPress REST API does, instead of silently saving a draft. An agent flow that relied on that silent fallback will receive an error from now on.
- Behavior change: the listing abilities validate status against the statuses actually registered on the site and return invalid_status for anything else. Custom statuses such as WooCommerce’s wc-processing now work, and a typo no longer falls back to date/publish without saying so.
- Credit: the authorization issues in this release were reported privately by stilwel, who reproduced them on their own test installation and withheld disclosure until a fix was available.
Enable Abilities for MCP 2.13.2
- New: FAQ entry for the ChatGPT connector failing with “metadata must advertise PKCE support with code_challenge_methods_supported containing S256”. Both Claude and ChatGPT fetch the discovery documents server-side with a python-httpx User-Agent, so a WAF blocking it breaks the connector while every…
- Updated: the MCP Adapter links now point to its WordPress.org page instead of its GitHub releases. The plugin was published to the directory on 2026-10-02, so it can be installed from the dashboard like any other plugin.
Enable Abilities for MCP 2.13.1
- Security fix: turning the “claude.ai OAuth Custom Connector” switch off now ends every existing OAuth connector session on that site. Before, the sessions were only unreachable while the switch was off, so turning it back on let an old connector reconnect on its own for up to 30 days without a new…
- Security fix: the OAuth server now stays off while the switch is off even when another plugin boots the same OAuth library. On some multisite networks the MCP endpoint kept answering, and accepting existing tokens, with the switch off.
- Security fix: changing a user’s password, or using “Log Out Everywhere” on their profile, now also ends that user’s OAuth connector sessions. Application Passwords the user created by hand are never touched.
- Fix: deactivating the plugin ends its OAuth connector sessions, so they cannot come back when it is activated again.
- Improvement: the Application Password behind each OAuth session is now named “MCP OAuth – – ” instead of just the client name, and its “Last Used” and “Last IP” columns are filled in, so you can see what you are revoking under Users › Profile › Application Passwords.
- New: Regression suite for session revocation (tests/oauth-sessions-test.php). Runs without WordPress: php tests/oauth-sessions-test.php.
Enable Abilities for MCP 2.13.0
- New: the CPT abilities can manage post types that are not public, when they are on an explicit allowlist. Tutor LMS topics is on it by default when Tutor LMS is active, so an assistant can finally build a course tree: course, topic, lesson. Every other non-public type is still rejected, WordPress b…
- New: ewpa/update-cpt-item accepts post_parent and menu_order, mirroring ewpa/create-cpt-item. A hierarchical item created in the wrong place, or a duplicate, can now be re-parented and reordered instead of being stuck. An item cannot be made its own parent, and a missing parent is refused.
- New: Regression suite for the post type guard and the update path (tests/cpt-abilities-test.php, 21 checks). Runs without WordPress: php tests/cpt-abilities-test.php.
Enable Abilities for MCP 2.12.0
- New: ability sections in Settings › WP Abilities collapse like an accordion. Click a section header to open or close it; the “All” checkbox keeps working without toggling the section. Sections start collapsed, and the ones you open stay open in that browser.
- New: each ability section shows how many of its abilities are enabled (for example, 2/3), updated as you change the toggles.
Enable Abilities for MCP 2.11.1
- Fix: the plugin no longer ships its own copy of MCP Adapter. The OAuth library pulled MCP Adapter 0.5.0 into vendor/ as a dependency. Development builds of MCP Adapter check for a copy loaded before them; because this plugin loads first, they found that copy, showed “Another version of MCP Adapter…
- Fix: the “requires the MCP Adapter plugin” notice now detects the MCP Adapter plugin itself, so it no longer appears when the plugin is active but installed in a folder with a different name.
Enable Abilities for MCP 2.11.0
- New: ewpa/get-code-snippets and ewpa/get-code-snippet (Code Snippets section, enabled by default) list the snippets stored by the Code Snippets plugin (without their code) and read one snippet by ID, including its code. Requires manage_options.
- New: ewpa/update-code-snippet (opt-in) changes a PHP snippet’s name, description, code, scope, or tags, leaving every other field untouched. New code goes through the same syntax check and blocked-function list as ewpa/create-code-snippet; an active snippet whose code changes is deactivated so the…
- New: ewpa/set-code-snippet-active (opt-in) deactivates a snippet immediately, but never activates one directly. Asking for activation files a request and returns a wp-admin link where an administrator reads the code and approves or rejects it. The approval form needs a WordPress login nonce, which…
- Fix: ewpa/create-code-snippet stored snippets created with scope: frontend as global, because Code Snippets names that scope front-end and silently falls back to global for values it does not know, so a snippet meant for the front end also ran in wp-admin. Both spellings are now accepted and stored…
- Fix: abilities marked opt-in (disabled by default) were enabled on fresh installs, because the first activation enabled every ability. New installs now leave them off; existing installs keep their current settings. ewpa/remove-menu-item, ewpa/assign-menu-location, and ewpa/delete-menu are now flagg…
- Fix: the Code Snippets section showed “plugin is not active” with Code Snippets 3.10 or later, whose API moved into a namespace.
- New: Regression suite for the Code Snippets helpers and the confirmation flow (tests/code-snippets-test.php, 33 checks). Runs without WordPress: php tests/code-snippets-test.php.
- Updated: Total abilities: 112 in 21 categories.
Enable Abilities for MCP 2.10.1
- Fix: ewpa/duplicate-post copied the internal translation-group taxonomies of Polylang and Linguator AI along with regular terms, so on a multilingual site the duplicate joined the original’s translation group and its language switcher and translation links pointed at the original’s translations. Th…
- Fix: ewpa/link-post-translation and ewpa/link-term-translation reported success on Polylang even when Polylang discarded the link because the translated post or term did not already carry the target language. They now assign that language first, as the WPML and Linguator AI backends already did, an…
- Fix: ewpa/list-languages returned term_id 0 for every Polylang language; it now returns each language’s term ID.
Enable Abilities for MCP 2.10.0
- New: Linguator AI support in the Multilanguage section, alongside Polylang and WPML: detection, languages, post and term languages, and translation groups through Linguator’s public API. Contributed by @drbelt27.
- New: ewpa/create-post-translation (Multilanguage, enabled by default) creates the translation of a post or page in a target language and links it to the source. The AI supplies the translated title, content, and excerpt; the ability never calls a translation service. Taxonomies, custom fields, and…
- New: ewpa/create-term-translation (enabled by default) does the same for categories, tags, and custom taxonomy terms: translated name and description, term meta copied, and the parent remapped to its target-language counterpart. Updating an existing translation changes only the supplied fields. Con…
- New: ewpa/list-languages, ewpa/set-term-language, ewpa/link-term-translation, and ewpa/get-term-translations (enabled by default) list the configured languages and manage term languages and translation groups. Contributed by @drbelt27.
- New: Regression suite for the multilanguage backend (tests/multilanguage-backend-test.php, 42 cases), with test doubles that unslash like WordPress core and validate languages like Polylang. Runs without WordPress: php tests/multilanguage-backend-test.php.
- Updated: Total abilities: 108 in 21 categories.
Enable Abilities for MCP 2.9.0
- New: ChatGPT & Other OAuth Connectors (beta, opt-in, off by default) — RFC 7591 dynamic client registration at /oauth/register, so ChatGPT and other self-registering clients connect through the same login-and-consent flow as the claude.ai connector. The security boundary is an administrator-managed…
- New: Regression suite for the connector callback allowlist (tests/oauth-connectors-test.php, 42 checks) covering redirect-URI smuggling — userinfo and backslash authorities, subdomain confusion, port and path-prefix mismatches, query strings and fragments through wildcards, protocol-relative and no…
- Fix: IPv6 loopback redirect URIs (http://[::1]:port/…) were rejected, because PHP’s parse_url() keeps the brackets around an IPv6 literal and the loopback check only knew ::1. It failed closed, so nothing was ever allowed that should not have been; native clients on IPv6 loopback can now connect. F…
Enable Abilities for MCP 2.8.1
- New: ewpa/assign-post-terms (Write section, enabled by default) — assigns a custom taxonomy’s terms to a post or page. ewpa/assign-cpt-terms explicitly rejects built-in post types (post, page, attachment, and others) by design, since native categories/tags on posts are already covered by ewpa/updat…
- Updated: Total abilities: 102 in 21 categories.
Enable Abilities for MCP 2.8.0
- New: Accessibility (WCAG) section — ewpa/get-accessibility-snapshot (read, enabled by default) scans the media library for images missing alt text (WCAG 1.1.1 Non-text Content) and returns a paginated list, so they can be fixed via ewpa/update-post-meta (_wp_attachment_image_alt). Deliberately narr…
- Updated: Total abilities: 101 in 21 categories.
Enable Abilities for MCP 2.7.2
- New: JetEngine Query Builder section (3 abilities) — ewpa/je-list-queries and ewpa/je-get-query (read, enabled by default) list and read Query Builder queries via JetEngine’s own internal data layer (Jet_Engine\Query_Builder\Manager); ewpa/je-update-query (write, opt-in) updates an existing query’s…
- Updated: Total abilities: 100 in 20 categories.
Enable Abilities for MCP 2.7.0
- New: ewpa/get-term-meta and ewpa/update-term-meta (Custom Post Types section, enabled by default) — read and write taxonomy term meta by exact key, the term-level equivalent of ewpa/get-post-meta / ewpa/update-post-meta. get-term-meta returns every meta field for the term when meta_key is omitted.…
- Fix: ewpa/get-cpt-taxonomies threw an output-schema validation error (“not of type string”) for taxonomies registered with 'label' => false — a pattern used by internal taxonomies some multilingual plugins (e.g. Polylang) attach to custom post types. The taxonomy slug is now used as a fallback labe…
- Updated: Total abilities: 96 in 19 categories.
Enable Abilities for MCP 2.6.0
- New: FSE Block Templates section (3 abilities) — ewpa/fse-list-templates and ewpa/fse-get-template (read, enabled by default) list and read wp_template / wp_template_part entries for the active theme via get_block_templates() / get_block_template(), merging theme-file defaults with database overrid…
- Fix: ewpa/create-code-snippet failed on every call with “Cannot instantiate Snippet class” on Code Snippets 3.10.0+ — its PSR-4 refactor moved the Snippet class from Code_Snippets\Snippet to Code_Snippets\Model\Snippet. Now checks both locations (plus the legacy global Snippet for 2.x), so it works…
- Docs: “Available Abilities” section now documents the Multilanguage, LearnDash, JetEngine Options Pages, Elementor, Code Snippets, and AI Agent Readiness (llms.txt) sections — previously listed only in the Features summary, not broken out in detail.
- Compatibility: Tested up to WordPress 7.1.
- Updated: Total abilities: 94 in 19 categories.
Enable Abilities for MCP 2.5.2
- Fix: ewpa/search-replace matched against a sanitize_text_field()-cleaned copy of the search term instead of the raw text — a search containing HTML tags, line breaks, or repeated whitespace would silently never match post_content (which stores that raw). The search and replacement values are now us…
- Fix: ewpa/search-replace rejected a search term of "0" as empty, because PHP’s empty() treats the string "0" as falsy. Now uses a strict empty-string check.
- Fix: Stable tag in this readme was left at 2.5.0 after the 2.5.1 release, so WordPress.org never picked up 2.5.1 as current. Corrected to 2.5.2.
Enable Abilities for MCP 2.5.1
- Fix: ewpa/tutor-get-user-progress always returned enrollment_status: null — Tutor’s EnrollmentModel::is_enrolled() doesn’t select post_status in its query, so the field silently read as null. Now resolved via get_post().
- Docs: v2.5.0 also shipped 6 Tutor LMS parity abilities (list courses, get course detail with topics/lessons hierarchy, get user progress, get quiz results, enroll user, unenroll user) that were left undocumented in that release — now reflected here and in the Available Abilities list.
- Updated: Total abilities: 91 in 18 categories (corrected from the 85 mistakenly listed in 2.5.0).
Enable Abilities for MCP 2.5.0
- New: ewpa/duplicate-post — duplicates any post, page, or CPT item, copying all post meta (ACF fields, SEO data, featured image) and taxonomy terms. The copy is saved as a draft by default. Opt-in write ability.
- Fix: meta values are now re-slashed before add_post_meta() to match WordPress’s internal wp_unslash() contract — prevents backslash loss in serialized or JSON meta fields (e.g. _elementor_data) when duplicating.
- Fix: self-healing migration automatically adds ewpa/duplicate-post to the enabled-abilities list on existing installs upgrading from earlier versions.
- Updated: Total abilities: 85 in 18 categories.
- i18n: POT and Spanish (es_ES) translation updated.
Enable Abilities for MCP 2.4.0
- New: Tutor LMS section — 2 abilities to read and set a lesson’s video source: ewpa/tutor-get-lesson-video and ewpa/tutor-update-lesson-video, both enabled by default. Requires Tutor LMS (tutor_utils()).
- Fix: writing a lesson’s video through the generic ewpa/update-post-meta ability silently broke video playback — Tutor stores _video as a native PHP array, but update-post-meta always writes strings, and WordPress’s own serialization safeguards (is_serialized()) prevent a plain or hand-serialized st…
- Updated: Total abilities: 84 in 18 categories.
- i18n: POT and Spanish (es_ES) translation updated.
Enable Abilities for MCP 2.3.0
Enable Abilities for MCP 2.2.1
Enable Abilities for MCP 2.2.0
Enable Abilities for MCP 2.1.1
Enable Abilities for MCP 2.1.0
Enable Abilities for MCP 2.0.25
Enable Abilities for MCP 2.0.24
Enable Abilities for MCP 2.0.23
Enable Abilities for MCP 2.0.22
Enable Abilities for MCP 2.0.21
Enable Abilities for MCP 2.0.20
Enable Abilities for MCP 2.0.19
Enable Abilities for MCP 2.0.18
Enable Abilities for MCP 2.0.17
Enable Abilities for MCP 2.0.16
Enable Abilities for MCP 2.0.15
Enable Abilities for MCP 2.0.14
Enable Abilities for MCP 2.0.13
Enable Abilities for MCP 2.0.12
Enable Abilities for MCP 2.0.11
Enable Abilities for MCP 2.0.10
Enable Abilities for MCP 2.0.9
Enable Abilities for MCP 2.0.8
Enable Abilities for MCP 2.0.7
Enable Abilities for MCP 2.0.6
Enable Abilities for MCP 2.0.5
Enable Abilities for MCP 2.0.4
Enable Abilities for MCP 2.0.3
Enable Abilities for MCP 2.0.2
Enable Abilities for MCP 2.0.1
Enable Abilities for MCP 1.9.3
Enable Abilities for MCP 1.9.2
Enable Abilities for MCP 1.9.1
Enable Abilities for MCP 1.9.0
Enable Abilities for MCP 1.8.0
Enable Abilities for MCP 1.7.0
Enable Abilities for MCP 1.6.0
Questions about Enable Abilities for MCP’s releases
What is the latest version of Enable Abilities for MCP?
2.15.0, released on Nov 6, 2026 (3 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 8.0 or later.
How often is Enable Abilities for MCP updated?
62 releases in the last year, about one every 4 days. Its first release on WordPress.org dates from March 2026.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in Enable Abilities for MCP’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.