Security auditor for the WordPress Abilities API. Scans registered abilities for permission, schema, and exposure risks.

Oleg Petrov

DiveWP – Boost Site Performance with Clear, Actionable Steps

Learn WP Best Practices Through Your Own Site! Get clear insights about Performance, Security, and Best Practices – explained in plain English.

Azizul Hasan

AtlasAiDev

AI Workflow Automation – AI Agent Hub

AI-powered WordPress hub: 80+ abilities, MCP server, block editor AI experiments, RBAC, JWT auth, and workflows.

sudowp

SudoWP Radar is a runtime security auditor for the WordPress 6.9 Abilities API. It scans every registered ability across all active plugins and themes, applying a rule engine that detects the vulnerability patterns most likely to be exploited in production.
What it audits:
<ul>
<li>Open and weak permissions — abilities with no permission_callback, or one that allows any authenticated user through.</li>
<li>Missing or loose input schemas — abilities that accept unconstrained string inputs, creating potential injection vectors for path traversal, SSRF, and similar attacks.</li>
<li>REST overexposure — abilities marked show_in_rest with no or open permission control, accessible to unauthenticated callers.</li>
<li>MCP overexposure — abilities marked meta.mcp.public = true with a weak or null permission callback are directly callable by any connected AI agent. Flagged as CRITICAL.</li>
<li>Orphaned callbacks — execute_callbacks that reference functions no longer loaded, often left behind by deactivated plugins.</li>
<li>Namespace collisions — duplicate ability names where the last registration silently overwrites the first, potentially downgrading the permission model.</li>
</ul>
How it works:
SudoWP Radar reads the live abilities registry after all plugins and themes have loaded. It applies static rules to each ability and returns a structured findings report with severity ratings (Critical, High, Medium, Low) and actionable remediation guidance. A risk score from 0-100 summarises the overall exposure of the site.
Security model:
<ul>
<li>Requires the <code>radar_run_audit</code> capability (granted to site administrators by default).</li>
<li>All audit requests are nonce-gated. No public-facing endpoints.</li>
<li>Audit findings are stored in user meta, not global options.</li>
<li>Rate-limited to one audit per 30 seconds per user.</li>
</ul>
Optional premium extension (SudoWP Pro):
The free plugin is a fully functional standalone security auditor. An optional premium add-on extends it with SudoWP Vulnerability Dataset matching (CVE references, CVSS scores, patch guidance), scheduled audits with email alerts, multi-site dashboard aggregation, and report export. None of these are required to use the core auditing features.
SudoWP Radar is a complement to static analysis tools. It audits the live, runtime state of your site — what is actually registered and executing — not just what is declared in code.
<h3>Premium Extension Filters</h3>
SudoWP Radar exposes four WordPress filters so a premium plugin can extend 
the audit engine without modifying core plugin files.
<h4>radar_dataset_enabled</h4>
Controls whether dataset lookups run during an audit. Return true to activate.
Parameters: 
 $enabled (bool) — default false. 
 Returns: 
 bool
Example:
<pre><code>add_filter( 'radar_dataset_enabled', function ( bool $enabled ): bool {
 return true; // Enable dataset lookups.
} );
</code></pre>
<h4>radar_dataset_findings</h4>
Inject Finding objects from a vulnerability dataset for a specific ability. 
Called once per ability during an audit. Non-Finding return values are stripped.
Parameters: 
 $findings (array) — current Finding[] for this ability, default []. 
 $ability (array) — ability data array from Scanner (name, meta, callbacks, etc.). 
 Returns: 
 Finding[]
Note: register with accepted_args=2 to receive both parameters.
Example:
<pre><code>add_filter(
 'radar_dataset_findings',
 function ( array $findings, array $ability ): array {
 if ( str_starts_with( $ability['name'], 'my-plugin/' ) ) {
 $findings[] = new \SudoWP\Radar\Finding(
 ability_name: $ability['name'],
 severity: \SudoWP\Radar\Finding::SEVERITY_CRITICAL,
 vuln_class: \SudoWP\Radar\Finding::VULN_DATASET_MATCH,
 message: 'Known vulnerable ability pattern detected (CVE-2026-1234).',
 recommendation: 'Update my-plugin to version 2.1.0 or later.',
 is_premium: true,
 );
 }
 return $findings;
 },
 10,
 2
);
</code></pre>
<h4>radar_dataset_status</h4>
Override the dataset status array displayed in the admin UI.
Parameters: 
 $status (array) — default status with keys: 
 enabled (bool) — false in free version. 
 label (string) — UI display string. 
 last_updated (string|null) — ISO 8601 date or null. 
 total_entries (int) — 0 in free version. 
 Returns: 
 array (same shape as input)
Example:
<pre><code>add_filter( 'radar_dataset_status', function ( array $status ): array {
 return [
 'enabled' => true,
 'label' => 'SudoWP Vulnerability Dataset: Connected. 4,821 entries.',
 'last_updated' => '2026-03-08',
 'total_entries' => 4821,
 ];
} );
</code></pre>
<h4>radar_audit_findings</h4>
Modify the complete findings array after all rules and dataset lookups have run. 
Use this to add cross-ability findings, re-score existing findings, or suppress 
false positives. Called once per full audit run.
Parameters: 
 $findings (array) — complete Finding[] from the full audit. 
 $abilities (array) — all ability data arrays scanned during this audit. 
 Returns: 
 Finding[]
Note: register with accepted_args=2 to receive both parameters.
Example:
<pre><code>add_filter(
 'radar_audit_findings',
 function ( array $findings, array $abilities ): array {
 // Example: promote medium findings to high for a high-risk site.
 return array_map( function ( $finding ) {
 if ( $finding->severity === \SudoWP\Radar\Finding::SEVERITY_MEDIUM ) {
 return new \SudoWP\Radar\Finding(
 ability_name: $finding->ability_name,
 severity: \SudoWP\Radar\Finding::SEVERITY_HIGH,
 vuln_class: $finding->vuln_class,
 message: $finding->message,
 recommendation: $finding->recommendation,
 context: $finding->context,
 is_premium: $finding->is_premium,
 );
 }
 return $finding;
 }, $findings );
 },
 10,
 2
);
</code></pre>

Alternatives to SudoWP Radar

Top alternatives