wp-ability-auth

Audit or implement authorization for WordPress abilities (wp_register_ability) and REST routes using a two-tier permission model — a coarse capability gate in permission_callback and a per-object meta-capability check inside the execute callback. Use when adding permission_callback logic, reviewing wp_register_ability or register_rest_route authorization, hunting IDOR gaps, centralizing an ability→capability map, enforcing a consistent WP_Error 403 contract, or hardening abilities invoked via MCP/agent or background contexts.

Compatibility

WordPress plugins/themes registering abilities via wp_register_ability or REST routes via register_rest_route; PHP 7.4+.