Skip to content
Per Søderlind
New site — Virtual Media Folders now has its own home. Visit vmf.soderlind.no →

WordPress Ability Authorization (Two-Tier)

Audit or implement authorization for WordPress abilities (wp_register_ability) and REST routes using a two-tier permission model — a coarse capability gate in permission_callback and a per-object meta-capability check inside the execute callback. Use when adding permission_callback logic, reviewing wp_register_ability or register_rest_route authorization, hunting IDOR gaps, centralizing an ability→capability map, enforcing a consistent WP_Error 403 contract, or hardening abilities invoked via MCP/agent or background contexts.

  • Version: 1.0.0
  • Compatibility: WordPress plugins/themes registering abilities via wp_register_ability or REST routes via register_rest_route; PHP 7.4+.

Install

Section titled “Install”
Terminal window
npx skills add soderlind/skills --skill wp-ability-auth -g

When to use

Section titled “When to use”
  • Adding or reviewing permission_callback on wp_register_ability / register_rest_route.
  • Auditing abilities for IDOR (missing per-object authorization).
  • Centralizing an ability→capability map, or fixing an inconsistent auth error contract.
  • Hardening abilities that may run with no current user (MCP/agent/background contexts).

📦 Source: soderlind/skills · Edit on GitHub