See which AI agents, REST clients and user roles can run each ability on your site, graded by severity, without ever executing one.
WordPress 6.9 introduced the Abilities API, a registry that lets plugins expose actions to the REST API, MCP servers and AI agents. WooCommerce already registers abilities such as product-delete and order-update-status and marks them destructive. The only thing deciding who may run each one is its permission callback. Flags like show_in_rest, public and mcp.public control who can see an ability, not who is allowed to run it. Nothing in core tells you whether a logged-out visitor or a subscriber can call a delete.
Ability Auditor reads every registered ability and calls its permission check as simulated, in-memory users for each role: Anonymous, Subscriber, Contributor, Author, Editor, Shop manager (when WooCommerce adds it) and Administrator. It then grades what it finds with a rules engine and shows the results in a report under Tools in wp-admin.
An execution guard blocks any attempt to execute an ability during an audit and reports it.
Permission checks run as simulated in-memory users for seven roles; Pass, Deny or Inconclusive for each.
Nine rules from Critical to Info flag low-privilege writes, exposed destructive abilities and loose schemas.
Shows where each ability is reachable and whether exposure is explicit, inherited from public or a default.
JSON, CSV and a print-friendly report, plus the last 20 audits with new-finding highlighting.
Daily and post-update audits with email alerts for new high findings; --fail-on for CI pipelines.
Every plan comes with the full plugin, a license key the moment you pay, and updates and support while your license is active.
Black Friday Sale
First year at the offer price, then $29/yr.
First year at the offer price, then $59/yr.
First year at the offer price, then $119/yr.
One payment, yours forever.
What Ability Auditor needs to run, and what it works with.
No. Ability Auditor reads ability definitions and calls permission checks as simulated in-memory users. An execution guard blocks any attempt to run an ability during an audit and the report flags it. No user, role or capability is created or changed, and results are stored in the plugin's own table.
WordPress 6.9 or later, because that is where the Abilities API was introduced, and PHP 7.4 or later. On older WordPress the plugin shows a notice and stays inert. Features added in WordPress 7.1, such as the public flag, are detected and used only when present.
Yes. Run wp ability-audit run --format=json or --format=csv for machine-readable output, and add --fail-on=critical or --fail-on=high to exit with status 1 when findings at or above that severity exist. --no-save skips writing the audit to history.
Install and activate the plugin under Plugins, then go to Tools > Ability Auditor License, enter the key from your order confirmation and click Activate. Updates are then offered on the Plugins screen and come from technoleet.dev, not WordPress.org.
The plugin keeps working. Audits, reports, exports, scheduled audits and WP-CLI are never gated by the license. You stop receiving updates and support until you renew.
Through your account at technoleet.dev. Include the ability name and the text of the finding, or the output of wp ability-audit run --format=json.
Pay once a year, get your license key instantly, and install it in a minute. Updates and support are included.
Security · Updates
Inspects every premium plugin update before it installs, holds risky packages for your approval, and catches hidden plugins and file changes.
Accessibility · Content
Finds accessibility problems in your block content, proposes a fix for each, and changes nothing until you approve the exact diff.
WooCommerce · Promotions
Proposes WooCommerce promotions from your own sales data, shows the margin first, and triages reviews. You approve everything; every change reverts.
