What 1.7.6 changes: an OAuth token now works on the MCP route only
Before 1.7.6, an OAuth token for the MCP endpoint also signed its holder in elsewhere on a WordPress site. What it reached, what changed, and what else shipped.
Read moreBefore 1.7.6, an OAuth token for the MCP endpoint also signed its holder in elsewhere on a WordPress site. What it reached, what changed, and what else shipped.
Read moreWordPress returns one value for both 'nothing here' and 'could not ask'. Nine review rounds on 1.7.5 kept finding that bug, once in a consent check.
Read moreThe sign-in screen now identifies a connector by its verified redirect host, and the Activity Log records requests that reach WordPress and fail.
Read moreA default of ours stopped ChatGPT connecting. Also fixed: a mangled redirect address, a session ID for a session never written, and a tool list that ate memory.
Read moreA completed sign-in with no tool calls after it usually means a CDN or firewall blocked the request. Read that in the Activity Log, confirm it, and fix it.
Read moreVersion 1.7.0 closes an OAuth revocation race, stops a payment gateway credential leak, and fixes four ACF writes that were destroying content.
Read moreA user-reported OAuth bug and six related fixes bring error responses, discovery, and tool status codes in line with what MCP and OAuth clients expect.
Read moreVersion 1.4.0 adds a one-screen Quick Connect wizard that gets an agent connected fast, without loosening the off by default governance underneath.
Read moreIn 1.3.0 we turned OAuth off by default and fixed real security gaps in our own plugin, patched in the open. Here is what changed.
Read moreTwo honest ways to connect an AI agent to your WordPress site, what each one is good at, and how to pick the one that fits your setup.
Read more