SudoWP Radar for WordPress

WordPress 7.0 introduced a new AI attack surface. Every plugin that registers

an ability on your site declares a structured entry point for AI agents and MCP

tools. SudoWP Radar audits that surface at runtime, flagging misconfigurations

before they become incidents.

It sits between reactive CVE scanners (which wait for a vulnerability to be

disclosed) and developer-side static analysis tools (which run before deployment).

Radar audits what is actually registered and executing on your live site, right now.

What it audits Core ability rules (WP 6.9+)

Open and weak permissions — abilities with no permission_callback, or one that

passes any authenticated user through regardless of role.

Missing or loose input schemas — abilities that accept unconstrained string

inputs on fields like path, file, url, redirect, or slug. Common injection

vector for path traversal and SSRF.

REST overexposure — abilities marked show_in_rest with no or open permission

control, reachable by unauthenticated callers.

Orphaned callbacks — execute_callbacks referencing functions no longer loaded,

typically left behind by deactivated plugins.