Pinch to Post - Manage WordPress sites through WP Pinch MCP server

• Analyzed: May 12, 2026, 3:03 AM
• Findings: 1
• Version: 5.5.1
• Hash: f48129a54031e7f8c43eb20b46f168db7944661ee782a3e58f46bec57c679140
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill exposes a wide range of powerful administrative capabilities for WordPress, including managing plugins, themes, users, cron events, and uploading media from URLs. While the `SKILL.md` explicitly instructs the AI agent to only use predefined MCP tools and not to execute arbitrary commands (e.g., `curl`), and claims robust server-side protections (PII redaction, option denylists, role escalation blocking), the sheer breadth of these capabilities (e.g., `wp-pinch/upload-media` from URL, `wp-pinch/toggle-plugin`, `wp-pinch/manage-cron`) presents a significant attack surface. If the underlying WP Pinch plugin or MCP server has vulnerabilities (e.g., SSRF in URL uploads, bypasses in option/role protections), these capabilities could be exploited, making the skill's overall risk profile higher than benign.