Critical-risk tools in Claudeus WordPress MCP
21 of the 145 tools in Claudeus WordPress MCP are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
claudeus_wp_astra__delete_custom_layoutDestructiveDelete an Astra custom layout. Removes the custom header, footer, or hook layout.
-
claudeus_wp_comments__delete_commentDestructiveDelete a comment permanently or move to trash.
-
claudeus_wp_comments__spamDestructiveMark a comment as spam. Removes it from public view and marks it for spam filtering.
-
claudeus_wp_comments__trashDestructiveMove a comment to trash. Comment can be restored later or permanently deleted.
-
claudeus_wp_content__delete_blockDestructiveDelete a reusable block
-
claudeus_wp_content__delete_block_revisionDestructiveDelete a specific block revision permanently
-
claudeus_wp_content__delete_pageDestructiveDelete a page
-
claudeus_wp_content__delete_page_revisionDestructiveDelete a specific page revision permanently
-
claudeus_wp_content__delete_postDestructiveDelete a post
-
claudeus_wp_content__delete_post_revisionDestructiveDelete a specific post revision permanently
-
claudeus_wp_media__deleteDestructiveDelete a media item
-
claudeus_wp_menus__delete_menuDestructiveDelete a navigation menu. Remove a menu and unassign it from all locations.
-
claudeus_wp_menus__delete_menu_itemDestructiveDelete a menu item. Remove an item from a menu.
-
claudeus_wp_plugins__deleteDestructiveDelete a plugin. Permanently remove an inactive plugin from the site. Plugin must be deactivated first.
-
claudeus_wp_taxonomy__delete_categoryDestructiveDelete a category
-
claudeus_wp_taxonomy__delete_tagDestructiveDelete a tag
-
claudeus_wp_templates__delete_templateDestructiveDelete a custom template. Removes user-created templates (theme templates cannot be deleted).
-
claudeus_wp_templates__delete_template_partDestructiveDelete a custom template part. Removes user-created template parts (theme template parts cannot be deleted).
-
claudeus_wp_users__delete_userDestructiveDelete a WordPress user. Can reassign their content to another user.
-
claudeus_wp_users__revoke_app_passwordDestructiveRevoke (delete) a specific application password. Immediately invalidates the password.
-
claudeus_wp_widgets__delete_widgetDestructiveDelete a widget. Remove widget instance from its sidebar permanently.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.