Critical-risk tools in Wp Cli

Critical severity Wp Cli MCP Server 5 of 58 tools

5 of the 58 tools in Wp Cli are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

wp_plugin_delete Destructive

Permanently delete a WordPress plugin from the filesystem. The plugin must be deactivated first. This cannot be undone.
wp_post_delete Destructive

Delete a post
wp_theme_delete Destructive

Delete a theme
wp_theme_file_delete Destructive

Delete a file from a WordPress theme. Cannot be undone.
wp_transient_delete_all Destructive

Delete all WordPress transients (cached temporary data). Useful for clearing stale caches.

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Critical-risk tools in Wp Cli

Tools at critical risk

Attacks that target this class

More on Wp Cli

Enforce policy on every Wp Cli tool call.