Approvals, deletes and prompt injection 🛡️
WPVibe’s safety gate is a strength, and it’s on by default. Its safety FAQ says “Hard-to-undo operations wait for you:” permanent deletes of posts, pages, comments, users or plugins, raw SQL writes, site-wide search and replace, giving or removing administrator access, and user email, password or key site-setting changes. You approve gated work in the browser, with an option to approve operations of the same kind on that site for the next 30 minutes, up to 25 operations; WPVibe’s security page says gated operations can require a dry-run preview first. A per-site “Dangerously bypass approvals” switch turns the gate off for bulk work; it is off by default and administrator-only.
Two gaps are documented. “Some deletes do not ask.” WordPress keeps no trash for categories, tags, menu items and, on most sites, media, so these “are deleted for good when your AI removes them through the REST API, with no approval page.” And “Everyday edits do not ask.” Creating and editing posts, pages and products runs right away.
Easy MCP AI takes the opposite default. Its Ask before destructive actions switch (under Easy MCP AI > Settings > Access & safety) is opt-in and off on a fresh install. Turn it on and Easy MCP AI pauses its own delete, uninstall and other destructive tools for your approval, including tag, category, menu item and media deletes, which WPVibe’s documentation says run without an approval page when made through the REST API; at defaults, neither product pauses a tag delete. Approval requests expire after 15 minutes, and the approval page requires logging in as the WordPress user the AI acts as; API keys marked Unattended never pause, a tool on the Never ask for list runs without asking unless it is also on the Always ask for list, and a site’s approval filter can override both lists.
With the switch on and Claude Code connected through a full-access API key, on Easy MCP AI 2.2.2 and WordPress 7.1.3, the AI was asked to delete an unused tag called “Holiday 2025”. It checked that no post used the tag, then stopped: “The site requires your approval first”. The site’s approval page showed the operation, the requesting key and the expiry (Easy MCP AI offers an in-chat prompt first when the client supports it; in this headless session that prompt went unanswered, so the approval was given on the page); after approval the identical call ran, and the AI confirmed the tag was gone with no other content changed. The Audit log recorded the paused and the approved call.
Both products inherit the same category risk, and WPVibe states it plainly: “Anyone who can write text on your site can hide instructions in it.” OWASP’s LLM01 entry calls this indirect prompt injection: an LLM accepting input from external sources, such as websites or files, in ways that alter its behavior. On both, the first mitigation is the WordPress user the AI acts as: bind the connection to a user whose role fits the job. Easy MCP AI adds read-only credentials and per-tool scopes for work that reads untrusted content. Switching one of its tools off removes that tool, not every route to the action; what the AI can do is bounded by the connected user’s WordPress role and the credential’s permissions.
