WordPress · tool · fg-0098

WordPress MCP cannot set a post slug, Yoast fields or a script tag

Unsafe content: script tag

Verified 2026-09-22 · Confirmed by 0 builders · Trust 50/100

Cause

The mcp-wordpress create and update tools accept title, content, status, categories, tags, excerpt and featured media only. They refuse content containing script tags, so JSON-LD blocks fail.

Fix

Create the draft with the MCP, then finish slug, full content and meta in one REST call authenticated with an application password.

Apply

curl -u "$WP_USER:$WP_APP_PASSWORD" -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" -X POST https://example.com/wp-json/wp/v2/posts/<id> -H 'Content-Type: application/json' -d '{"slug":"my-slug","meta":{"_yoast_wpseo_title":"...","_yoast_wpseo_metadesc":"..."}}'

Affects: mcp-wordpress via npx, September 2026

claude mcp add --transport http footgun https://getfootgun.com/api/mcp