Security and disclosure
GoBuildWP security: report it privately. We fix it publicly.
GoBuildWP puts an MCP server inside WordPress and can, when you allow it, reach privileged surfaces. A vulnerability here is a route into somebody else's production site, so it gets a real disclosure process and an honest scope.
Disclosure process
What happens after you send the email
A report is acknowledged before it is triaged, and the reporter is told what we found even when the behaviour is intended. In return we ask for time to ship a fix before details are public, because the sites that need patching are not ours.
Do not include production credentials, private keys or customer data, and do not run exploit traffic against systems you do not own.
Report privately
Email security@gobuildwp.com with the affected version, environment, and a minimal reproduction. Do not open a public issue first.
Acknowledgement
We aim to confirm receipt within three business days and tell you whether we can reproduce it.
Assessment
We assess impact against the safety model, confirm which versions are affected, and agree a disclosure timeline with you.
Fix and credit
We ship a fix, note it in the changelog, and credit you by name unless you prefer otherwise.
Scope
What we want to hear about, and what we do not
The line sits at the safety model: anything that defeats it matters.
In scope
- Authentication or authorisation bypass in the MCP endpoint, OAuth 2.1 flow, or Application Password route
- Any path that lets a request run an ability the active safety profile should have blocked
- Escaping the Production Safe boundary into raw code, filesystem, WP-CLI, or administrator access
- Bypassing the confirmation gate on a destructive or critical operation
- Privilege escalation beyond the WordPress capabilities of the authenticated identity
- Secrets, tokens, or unredacted personal data leaking into the change ledger, diagnostics, or logs
- Cross-site scripting, CSRF, or injection in the GoBuildWP admin screens
- A Pro integration module reaching data or operations outside its declared surface
Out of scope
- Intended privileged operations explicitly granted by Developer Full Access. Unintended privilege escalation, cross-user access, secret exposure or policy bypass remains in scope even when that profile is enabled
- Reports against a WordPress site you do not own or have written permission to test
- Automated scanner output with no demonstrated impact on GoBuildWP
- Vulnerabilities in WordPress core, third-party plugins, or an AI provider, unless GoBuildWP makes them materially worse
- Missing hardening headers on marketing pages with no exploitable consequence
- Social engineering, physical access, or denial of service
Deployment guidance
Run it the way it was designed to be run
Review identity, profiles, confirmation and recovery together before running a production workflow. These controls reduce the permitted surface; they do not establish an incident rate or eliminate vulnerabilities.
- Keep Production Safe selected unless broader access is a deliberate, time-boxed decision.
- Prefer OAuth 2.1 with PKCE over credentials embedded in a client configuration file.
- Serve remotely reachable sites over HTTPS and revoke connected apps you no longer use.
- Use a dedicated WordPress identity and review the exact operation capabilities. GoBuildWP connection management requires manage_options on a single site or super-administrator authority on multisite; an ordinary Editor account is not sufficient for the documented initial workflow.
- Keep tested backups before you enable any mutation workflow.
- Review the GoBuildWP change ledger and your WordPress logs after consequential operations.
- Treat Developer Full Access, the PHP sandbox, WP-CLI, and temporary admin links as privileged server access.
For researchers and site owners
What a reproducible GoBuildWP vulnerability disclosure contains
A GoBuildWP vulnerability disclosure is triaged against the safety model, so the most useful report states which control should have stopped the request and how it did not. Write it so that someone with a fresh WordPress install can reach the same result without asking you a question.
- The Free and, if installed, Pro version numbers exactly as the Plugins screen shows them, plus WordPress and PHP versions and whether the site is a multisite network.
- The safety profile in force (Read Only, Production Safe or Developer Full Access), the confirmation mode, and whether the ability was enabled or disabled on GoBuildWP > Abilities.
- How the request authenticated: OAuth, an Application Password or a GoBuildWP access token, and, for a token, the ceiling and scope it was created with.
- The ability name, the input that triggered the behaviour with any secret replaced by a placeholder, the response you expected and the response you received.
- Whether the request went straight to the site or through GoBuildWP Cloud at app.gobuildwp.com.
The controls a report is measured against
Knowing what GoBuildWP claims to enforce makes it easier to tell a finding from intended behaviour. These are the server-side controls the plugin source implements, and a way around any of them is the kind of report the scope above describes.
- AI Abilities have a single site-wide switch on GoBuildWP > Connect a client, and once on they are locked to the hostname they were switched on for. A copy of the site on another domain answers with no abilities until an administrator re-enables them there.
- The safety profile is enforced on the server, not in the client. Production Safe blocks raw code execution, server filesystem access, WP-CLI and temporary administrator access; Read Only allows discovery and inspection only.
- An access token can carry a ceiling, a safety profile it can never exceed, and a scope of named abilities or categories. The effective profile is the stricter of the site's and the token's, so a token that reaches beyond either is a finding.
- Destructive and critical abilities require confirmation. In the default "Agent flag" mode the agent must send confirm=true; with "A person approves" selected under Confirmation, the exact call, with the same arguments, must be approved by an administrator in the client or on a one-time wp-admin page, and the approval cannot be granted by an agent holding the link.
- Each credential may run a limited number of ability calls per minute, read-only abilities excepted, and a site owner can change or remove that limit with a filter.
- Consequential changes are recorded in the change ledger, which should never contain a password, token or unredacted secret.
Testing safely on a site you control
Please test on your own install, not a client's site and not anyone's production. A local WordPress or a disposable staging copy with GoBuildWP Free from gobuildwp.com/download/latest is enough for nearly every report; add Pro only if the finding involves a Pro integration, and then only the companion plugin the integration needs. Do not point load or exploit traffic at gobuildwp.com, app.gobuildwp.com, our former domain or any site you do not own.
Because the domain lock disables AI Abilities whenever the hostname changes, a cloned test site will show no abilities until you re-enable them on the new address. That is expected, and not a bypass in itself; a way to use abilities on a changed hostname without that re-enable step would be.
For a finding inside a Pro integration, name the companion plugin and its exact version, because Pro loads an integration only when the plugin it drives is installed, active and at or above a minimum version. Output from the read-only wppilot/integration-health ability shows which integrations were eligible to load at the time, and including it settles early whether the code you exercised was the code you meant to test.
If you are a site owner responding to an incident
Not every security problem is a GoBuildWP vulnerability. If a credential that can reach your site has leaked, revoke it first and investigate second. An Application Password is revoked from Users > Profile on the user it belongs to. A GoBuildWP access token is revoked from its list on GoBuildWP > Connect a client. An OAuth connection is removed under "Manage connected apps" on the same screen. A site connected to GoBuildWP Cloud can be disconnected from either side, and disconnecting stops that site's Cloud key working.
Then switch the safety profile to Read Only while you look, and read the change ledger for what the credential did. If what you find suggests GoBuildWP let something through that its controls should have stopped, that is the point to email security@gobuildwp.com with the evidence; until then, the privacy page and the WordPress MCP security model explain what each component sees.
FAQ
Security questions, answered
Where do I report a GoBuildWP vulnerability?
Email security@gobuildwp.com privately with the affected version, environment details, and a minimal reproduction. Do not include production credentials, private keys, or customer data, and do not run exploit traffic against systems you do not own.
Is Developer Full Access a vulnerability?
No. Developer Full Access is documented as privileged server administration access, equivalent to giving someone the ability to run code on the server. Intended operations within that grant are not a bypass. Unintended cross-user access, secret exposure, escalation or policy bypass remains in scope, including when the profile is enabled. Reaching privileged capabilities from Read Only or Production Safe is also in scope.
Do GoBuildWP's audits replace a security scanner?
No. The security and performance audits inspect selected WordPress and PHP configuration. They are not a malware scanner, penetration test, compliance certification, or availability monitor, and should not be relied on as one.
Does GoBuildWP send my site data to an AI provider?
The plugin itself does not bundle or operate a model. External MCP clients use their own model access. The in-dashboard Chat sends prompts, attachments, instructions, tool declarations, and tool results to whichever provider you configure. The privacy page sets out that data flow in full.
Do you offer a bug bounty?
There is no paid bounty programme at this time. We do credit reporters in the changelog and will work with you on a disclosure timeline that lets sites update before details are published.
Found something? Tell us first.
Email security@gobuildwp.com with the version, environment and a minimal reproduction. We credit you when the fix ships.