WSP MCP changelog and version history

202619 releases

1. WSP MCP 2.9.7Latest

   Oct 29, 2026
   • New: ChatGPT tab on MCP > Connection with step-by-step instructions and a walkthrough GIF. The Claude Connectors tab also gets a walkthrough GIF.
   • Fixed: connecting ChatGPT and other OAuth clients on hosts that block /.well-known/ at the web server (for example SiteGround). OAuth discovery is now also served from a non-.well-known address.

2. WSP MCP 2.9.6

   Oct 21, 2026
   • Security: hardened authorization checks on post listing, Elementor, Ultimate Addons for Elementor and media upload tools. Update recommended.

3. WSP MCP 2.9.5

   Oct 9, 2026
   • New: Site Context — a new MCP > Context page where you write AGENTS.md (how your site is built and the rules to follow) and CHANGELOG.md (what changed and why). Turn on “Enable Site Context” (off by default) and every connected AI reads them first, so it doesn’t have to explore your whole site. Thi…
   • New: Update Site Context (wsp_update_site_context) — lets your AI write or update AGENTS.md and CHANGELOG.md itself (replace, append, or add a new entry at the top). Large files can be sent in chunks. Each document can now hold up to 300,000 characters (was 50,000). Administrators only, OFF by defa…
   • New: WooCommerce store management — 34 tools. Delete products, variations, coupons, categories and tags (products, variations and coupons go to the trash unless you ask for permanent deletion). Manage product categories, tags, global attributes and attribute terms. Read and update WooCommerce setti…
   • New: Plugin management — Install Plugin from WordPress.org (wsp_install_plugin), Install Plugin From URL (wsp_install_plugin_from_url, https .zip only), Delete Plugin (wsp_delete_plugin, must be deactivated first) and Update Plugin (wsp_update_plugin). They use WordPress’s own installer and require…
   • Improved: Read Plugins (wsp_get_plugins) now lists every installed plugin with its active state and available update. Create Category (wsp_create_category) can also create WooCommerce product categories.
   • All new tools are OFF by default.

4. WSP MCP 2.9.4

   Oct 6, 2026
   • New: Site Editor ability group for block (Full Site Editing) themes — six tools. Read Global Styles (wsp_get_global_styles) returns the site’s theme.json customizations or the merged effective values, and can list the theme’s style variations. Update Global Styles (wsp_update_global_styles) deep-me…
   • New: Widgets & Sidebars ability group for classic themes — eight tools. Read Sidebars, Read Widget Types, Read Widgets and Read Widget list widget areas, available widget types, placed widgets with their settings, and a single widget with its rendered HTML. Create Widget, Update Widget (change sett…
   • New: Site Health, Cron & Error Log ability group — six diagnostics tools. Read Site Health runs WordPress’s Site Health checks and returns status, performance and security recommendations plus server and WordPress info (private fields such as database credentials are left out). List / Inspect / Run…
   • New: Upload / Install Theme (wsp_upload_theme) — installs a theme generated by your AI agent (sent as theme files) or a theme .zip (base64 or URL), optionally replacing an existing copy and activating it. Uses WordPress’s own theme installer. Requires the install_themes capability (administrators;…

5. WSP MCP 2.9.3

   Oct 2, 2026
   • New: 5 Custom Post Type tools — list your custom post types, and list, create, update and trash their items (works with any public custom post type, e.g. books, events, portfolio). Off by default.
   • New: About Us page under MCP.
   • New: Settings, Connection and About Us links under the plugin name on the Plugins screen.
   • Improved: clearer plugin name, description and readme.

6. WSP MCP 2.9.2

   Sep 29, 2026
   • Minor updates.

7. WSP MCP 2.9.1

   Sep 28, 2026
   • New: Create User and Update User tools. Create User auto-generates a password if none is supplied and defaults the role to subscriber; Update User edits email, display name, role, or password. Require create_users / edit_users. OFF by default.
   • New: Update Site Info (title, tagline, admin email) and Update Permalink Structure tools. Require manage_options. OFF by default.
   • New: Activate Plugin and Deactivate Plugin tools. Require activate_plugins. Deactivate Plugin refuses to deactivate this plugin, so the MCP connection cannot cut itself off. OFF by default.
   • New: Themes tool group — Read Themes and Switch Theme. Require switch_themes. OFF by default.
   • Changed: Plugin home and docs moved to wspmcp.com. The sidebar tutorial and abilities-directory links now point there.
   • Contributed by @dulaj44.

8. WSP MCP 2.9.0

   Sep 17, 2026
   • New: Navigation Menus ability group — nine tools to list menus and their items, create and delete menus, add/update/remove menu items (custom links, posts, pages, categories), list theme menu locations, and assign or unassign a menu to a location. All require edit_theme_options (the same capability…
   • New: Read Post tool (wsp_get_post) — fetch a single post by ID in any status (draft, pending, private, trash) with its full content, so an AI agent can review a draft before updating it. Requires edit_posts plus per-post read permission; a Contributor cannot read another author’s private post. OFF…
   • Fixed: Permission-denied and not-found results from the new Read Post tool were being recorded as successful calls in the Audit Log; they are now logged as denied/error like every other tool.
   • Fixed: Add Menu Item now rejects an object_id whose post type does not match the requested type (e.g. type: page with a blog post ID) instead of silently storing it.

9. WSP MCP 2.8.0

   Sep 11, 2026
   • New: One-click Claude Connector sign-in. The plugin now runs its own OAuth 2.1 authorization server, so you can connect Claude by pasting only the server URL into Customize > Connectors > Add custom connector — no config file, no API key, no request header. Claude sends you to this site’s own login…
   • New: Analytics & Performance Dashboard in MCP > Analytics — summary cards for total requests, most-used tool, average response time, and error rate; a per-category tool-usage breakdown with lightweight CSS progress bars; and a recent-requests performance log. Built entirely on the existing Audit Lo…
   • New: “Claude Connectors” tab on MCP > Connection, now the first tab, covering the URL-only connection path above for claude.ai, Claude Desktop and Claude mobile (they share one Connectors screen). The classic config-file method is kept as its own tab.
   • New: Configuration Generator on MCP > Connection — pick an AI tool (Claude Desktop, Cursor, Codex, Antigravity, OpenClaw, OpenCode) and an authentication method, and the correct config snippet is built live in your browser with a one-click copy button. Application Password mode never sends your cre…
   • New: Download button beside Copy on every snippet, saving the exact config file directly. Cursor users also get a Connect Cursor Automatically button using Cursor’s official one-click MCP install link.
   • Security: The OAuth server ships hardened after a pre-release review — it is off until an administrator enables it, and switching it off disconnects anything already connected; approving a connector requires an account that can edit posts, so opening registration on your site does not open MCP acce…
   • Fixed: OAuth discovery on subdirectory installs (e.g. https://example.com/test/) could leave a connected connector with “no tools available.” Discovery documents are now served at every URL spelling this install can actually reach, and the two-install-on-one-domain case is disambiguated with a base…
   • Fixed: On a site with other active plugins (however many, of whatever quality), a stray PHP notice/warning printed by one of them during an ordinary WordPress hook could land in front of this plugin’s JSON response and break every MCP client’s JSON parser — Claude showed the connector as connected…

10. WSP MCP 2.7.1

    Sep 2, 2026
    • Security: Fixed a broken access control issue reported by Patchstack (Ananda Dhakal) as “Authenticated (Contributor+) Broken Access Control”, affecting WSP MCP <= 2.7.0, where the Update Post, Delete Post, Update Page, Delete Page, Update Media, Delete Media and Set Featured Image tools only checke…

11. WSP MCP 2.7.0

    Aug 21, 2026
    • New: Full Audit Log. Every MCP tools/call request is now recorded in a dedicated, self-hosted database table (wp_wsp_mcp_audit_log) — tool name, timestamp, acting user, request IP, and outcome (success, denied, or error). No external API or paid service is involved.
    • New: MCP > Audit Log admin page to browse, filter (by status or tool), and clear the log. Restricted to administrators (manage_options), matching every other MCP admin screen.
    • New: Log entries older than 90 days (filterable via wsp_mcp_audit_log_retention_days) are pruned automatically by a daily cron task, so the table stays lightweight.

12. WSP MCP 2.6.8

    Aug 12, 2026
    • Fixed: “Session not found or expired. Re-initialize.” on the very first request after initialize. Clients that send tools/list immediately (Claude Desktop via mcp-remote, and any fast script) landed in the same second as the initialize that created the session, so the expiry-sliding UPDATE wrote th…

13. WSP MCP 2.6.7

    Aug 8, 2026
    • Fixed: The “Copy” buttons on the MCP > Connection page did nothing on sites served over plain HTTP (such as local development hosts). The browser Clipboard API is only available in a secure context (HTTPS or localhost), so the copy now falls back to a hidden textarea when it is unavailable. All six…
    • Changed: Each ability group header now shows a green “N Enabled” and a red “N Disabled” pill instead of a single “enabled / total” badge, so partially-enabled groups are obvious at a glance. Counts update live as you flip switches.
    • New: Sidebar cards on the MCP > Settings and MCP > Connection pages linking to our video tutorials and the full abilities directory at freewordpressmcp.com.
    • Compatibility: Verified against WordPress 7.0.3. No plugin changes were required — the kses and HTTP URL-validation fixes in that release are inherited through core APIs. Because this plugin exposes tools to AI agents, we recommend running WordPress 7.0.3 or 6.9.6+ so the SSRF and CSS-injection fix…

14. WSP MCP 2.6.6

    Jul 27, 2026
    • New: Direct file upload for media. wsp_upload_media (Upload Media) now accepts base64 file content via a new data parameter — an MCP client can upload a file attached to the chat straight into the media library without first hosting it at a public URL. The url parameter still works as before; pass…

15. WSP MCP 2.6.5

    Jul 23, 2026
    • New: Elementor Advanced Design Tools — 11 tools for high-fidelity design workflows: get/update active kit, regenerate CSS, get widget schema, duplicate/move element, convert CSS to Elementor settings, get/update page settings, copy styles, and get breakpoints. All off by default under the “Elemento…

16. WSP MCP 2.6.2

    Jul 21, 2026
    • Docs: documented the complete 18-tool Gravity Forms suite (forms, entries, notifications, confirmations) across the readme, plugin docs, and changelog; the 2.6.1 notes under-reported it as 11 tools and omitted the notification, confirmation, and form-settings write tools. Corrected the capability n…

17. WSP MCP 2.6.1

    Jul 17, 2026
    • New: Gravity Forms suite — 18 tools covering forms (list, get, create, update, delete, update settings), entries (list, get, update, delete with trash/permanent), notifications (get, create, update, delete), and confirmations (get, create, update, delete). All write tools are off by default; list-f…
    • Docs: added a video tutorial to the plugin description and three connection walkthrough videos (OpenClaw, Google Antigravity 2.0, Codex) to the FAQ.

18. WSP MCP 2.5.0

    Jul 15, 2026
    • New: Full media library tool suite. Adds six media tools — List Media (browse/search by type, keyword, or date), Count Media (counts grouped by MIME type plus a total), Update Media (title, alt text, caption, description), Delete Media (permanent), Upload Media (from a URL), and Upload Media From U…

19. WSP MCP 2.4.1

    Jul 13, 2026
    • Security: ACF field-value write tools no longer accept raw code. Every value written via update_field() — for posts, users, terms, and options — is now recursively sanitized (arrays walked; each string run through wp_kses_post()) so <script>/<style> and inline event handlers can no longer be stored…