WordPress · api · fg-0096

WordPress application password stops working with no warning

{"code":"incorrect_password","message":"The provided password is an invalid application password."}

Verified 2026-09-22 · Confirmed by 0 builders · Trust 50/100

Cause

Application passwords can be revoked with no notice to integrations. incorrect_password means the user exists and the password is dead; invalid_username means the login name is wrong. A new application password cannot be minted through the API without a working credential.

Fix

Read the error code to tell the two apart. Regenerate the password in the user's profile while logged in, and store it where every integration reads from.

Apply

wp-admin > Users > Profile > Application Passwords > enter a name > Add New Application Password

Affects: WordPress 7.x core application passwords, September 2026

claude mcp add --transport http footgun https://getfootgun.com/api/mcp