SudoWP Radar

SudoWP Radar is a runtime security auditor for the WordPress Abilities API in WordPress 6.9 and later. It scans registered abilities across active plugins and themes, looking for misconfigurations that could become exploitable vulnerabilities.

The scanner reports open and weak permission callbacks, including __return_true and low capabilities such as read and exist. It also checks for missing or loose input schemas on sensitive fields including path, file, url, redirect, source, target, and slug. Additional findings include REST overexposure for abilities marked show_in_rest without proper permission control, MCP overexposure for abilities marked meta.mcp.public with a weak or null permission callback, orphaned callbacks that reference functions no longer loaded, and namespace collisions where duplicate registrations can silently downgrade permissions.

Several operational details are stated as part of the tool’s design. Audit results are stored in user meta rather than global options, rate limiting uses a 30-second transient per user, and there are no public AJAX endpoints. It also has zero external dependencies and makes no external HTTP calls. When the plugin is deleted, user meta and transients are removed.

Results appear in the WordPress admin as a severity-sorted list of findings with a 0-100 risk score. The page also says SudoWP Radar registers its own ability, sudowp-radar/audit, so an AI agent connected to a WordPress site via MCP can trigger a full security audit natively; that ability requires the radar_run_audit capability and is REST-disabled by default. A community version is available, and the page notes WordPress.org plugin submission pending.