Critical-risk tools in Wordpress
39 of the 314 tools in Wordpress are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
acf_delete_field_groupDestructiveDelete an ACF field group and its fields (stored post values are kept)
-
fields_delete_definitionDestructiveDelete a database definition. Stored field values stay in post/term/user meta and options.
-
fort_cache_purgeDestructivePurge the fort
-
legal_delete_sectionDestructiveDelete a section from a legal document.
-
legal_put_documentDestructiveReplace a whole legal document (every section not listed is gone). Sections are ordered; omit slug to derive it from the heading. The linked page
-
legal_reset_accessibility_reportDestructiveClear the markup repair report, e.g. after fixing the source, so new page views record afresh. Requires cvrt-legal 0.9.0+.
-
legal_restore_generatorDestructiveRestore a generated document to how it was before the generator first wrote it, and stop generating it. Requires cvrt-legal 0.7.0+.
-
mcp_bulk_delete_mediaDestructiveDelete multiple media items at once. Returns the deleted and failed IDs.
-
mcp_clean_commentsDestructivePermanently delete all spam and trashed comments
-
mcp_clean_revisionsDestructiveDelete old post revisions, keeping the newest
-
mcp_delete_cpt_postDestructiveDelete a post of any post type (moves to trash unless force is true)
-
mcp_delete_mediaDestructiveDelete a media item and its files
-
mcp_delete_menuDestructiveDelete a navigation menu
-
mcp_delete_menu_itemDestructiveDelete a menu item. Its children move up to its own parent; the response lists them as reparented.
-
mcp_delete_optionDestructiveDelete an option (404 if it does not exist)
-
mcp_delete_termDestructiveDelete a term from any taxonomy (permanent; terms have no trash)
-
mcp_delete_themeDestructiveDelete an inactive theme (the active theme is refused)
-
mcp_delete_userDestructiveDelete a user. WITHOUT reassign, all of the user
-
mcp_delete_widgetDestructiveRemove a widget from its sidebar
-
mcp_flush_cacheDestructiveFlush the WordPress object cache and delete all transients and site transients. Does NOT purge a page cache in front of WordPress (Bearfort forts: the nginx page cache is purged...
-
seo_clear_monitor_logDestructiveDelete 404 monitor log entries: one entry by id, or every entry last seen within from..to (inclusive dates, either bound optional). With no argument the WHOLE log is cleared. Re...
-
seo_delete_post_seoDestructiveDelete (reset) every SEO meta field of a post. Returns { deleted: true }.
-
seo_delete_redirectDestructiveDelete a redirect by id. Returns { deleted: true }.
-
seo_delete_term_seoDestructiveDelete (reset) every SEO meta field of a taxonomy term. Returns { deleted: true }.
-
stripe_recreate_webhookDestructiveRecreate this site
-
woo_delete_categoryDestructiveDelete a product category
-
woo_delete_couponDestructiveDelete a coupon permanently
-
woo_delete_productDestructiveDelete a WooCommerce product (to trash unless force)
-
woo_delete_variationDestructiveDelete a product variation permanently
-
woo_helper_create_invoiceDestructiveDESTRUCTIVE, IRREVERSIBLE: creates a REAL invoice for this order in the live sevDesk/Lexware ledger. An invoice there cannot be deleted, only cancelled with a cancellation invoi...
-
wp_delete_categoryDestructiveDelete a category permanently (its posts fall back to the default category)
-
wp_delete_commentDestructiveDelete a comment (moves to trash, or permanently if force=true)
-
wp_delete_mediaDestructiveDelete a media item and its files
-
wp_delete_pageDestructiveDelete a page (moves to trash, or permanently if force=true)
-
wp_delete_pluginDestructiveDelete an installed plugin (via cvrt-mcp-endpoints; deactivates first)
-
wp_delete_postDestructiveDelete a post (moves to trash, or permanently if force=true)
-
wp_delete_tagDestructiveDelete a tag permanently
-
wp_delete_userDestructiveDelete a user permanently, reassigning their content to another user
-
stripe_set_payment_methodFinancialTurn one payment method of a Stripe payment method configuration on or off (display preference). The method must exist in that configuration (see stripe_list_payment_method_conf...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.