by sudowp 0 (0 reviews)

SudoWP Radar

Name: SudoWP Radar
Author: sudowp

Security auditor for the WordPress Abilities API. Scans registered abilities for permission, schema, and exposure risks.

SudoWP Radar ranks #73,290 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Jul 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Tested up to WP 7.0.8 (Current: 7.1.4)

v1.3.0 Current Version v1.3.0

Updated 3 months ago Last Update on 13 Jul, 2026

Refreshed 2 days ago Last Refreshed on

#3,855 of 5,058 in Security

View on WordPress.org

Rank

#73,290

— No change

Active Installs

-100%

KW Avg Position

N/A

— No change

Downloads

498

+3 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 10

Total Progress 0%

0+ 10+

45,722

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 10 more installs to reach 10+

Rank Changes

Current #73,290

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.3.0
Last Updated: Jul 13, 2026
Requires WP: 6.9+
Tested Up To: 7.0.8
PHP Version: 8.1 or higher
Author: sudowp

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

abilities-api audit permissions scanner security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about SudoWP Radar

No. The core audit rules work on WordPress 6.9 and higher. The five AI agent rules (AI prompt filter bypass, AI REST overexposure, AI missing version gate, hosting-injected ability, connector key in database) are silently skipped on sites running below 7.0 -- no errors, no noise. If you are running 7.0, those rules activate automatically.

The Abilities API, introduced in WordPress 6.9, is the layer that allows AI agents and MCP tools to interact with your site programmatically. Plugins register named abilities with permission callbacks and input schemas. When an AI agent connects to your site, it can call these abilities directly. A misconfigured ability is a direct entry point -- not a theoretical risk.

Possibly. Some hosting providers auto-install AI agent plugins on customer sites without explicit consent. If that plugin registers abilities with REST exposure, or stores an AI provider key in your database, it expands your AI attack surface without your knowledge. Run a Radar audit to check. The hosting-injected ability rule (premium) and connector key in database rule (free) are designed to catch exactly this scenario.

WordPress 7.0 introduces a Connectors API that lets plugins register AI provider integrations (OpenAI, Anthropic, Google, and others). If the API key for one of these connectors was entered through the WordPress admin UI rather than defined as an environment variable or PHP constant, it is stored as plaintext in your database. Any SQL injection vulnerability or object cache exposure on your site would expose that key directly. The finding tells you which connector is affected and how to move the key to a safer location.

A Critical finding is an ability or endpoint that any user -- in some cases an unauthenticated visitor -- can call directly. This is the highest severity level and should be addressed before anything else.

No. Radar is a read-only auditor. It reads the Abilities registry and reports findings. It does not modify any registered abilities, alter plugin settings, or write to the database other than storing the last audit report in your own user meta.

No. The audit runs on demand only, triggered by clicking Run Audit in the admin. It does not run automatically and has no effect on front-end performance.

Radar registers a sudowp-radar/audit ability via the WP Abilities API, allowing MCP-connected AI agents to trigger audits programmatically. REST exposure is disabled by default -- the ability is only reachable by MCP agents with the appropriate permission, not by unauthenticated REST callers.

PHP 8.1 or higher.