wp-blocks-mcp

The server uses environment variables (WORDPRESS_URL, WORDPRESS_USERNAME, WORDPRESS_APP_PASSWORD) for authentication, which is good practice. However, it requires write access to the WordPress instance (e.g., to create/delete posts for rendering, create reusable blocks). A compromise of this server or its environment variables could lead to manipulation of the connected WordPress site. Input validation for tool arguments is performed using Zod, which helps mitigate direct injection risks for these specific inputs. The `JSON.parse` operation in `parse_blocks` relies on content from the WordPress API; while standard for block attributes, it could be a vector if the WordPress content itself is maliciously crafted by an attacker.