Wp Ajax Nopriv Visibility | Agent Skills Atlas

About this skill

Audit and fix WordPress AJAX handlers registered via wpajaxnopriv that build WPQuery args from client input. Catches the common pattern where a handler overrides poststatus/posttype to 'any' (or trusts client-supplied postin / author / metaquery) and ends up exposing private, draft, pending, future, trash, or auto-draft content to unauthenticated visitors. Use when reviewing or hardening any wpajaxnopriv endpoint, or when a report mentions "unauthenticated information disclosure" / "draft exposure" / "private post leak" in a WordPress plugin.

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1

Content SHA-256: 20d0fd15fd5bb32a9dee8cc803bc9bea409a5e39f7e852887bbd59a15829028d

About scan coverage and limitations

Original listing metadata

Original name

wp-ajax-nopriv-visibility

Original description

Audit and fix WordPress AJAX handlers registered via wp_ajax_nopriv_* that build WP_Query args from client input. Catches the common pattern where a handler overrides post_status/post_type to 'any' (or trusts client-supplied post__in / author / meta_query) and ends up exposing private, draft, pending, future, trash, or auto-draft content to unauthenticated visitors. Use when reviewing or hardening any wp_ajax_nopriv_ endpoint, or when a report mentions "unauthenticated information disclosure" / "draft exposure" / "private post leak" in a WordPress plugin.

About this listing

Category: General
Reported license: Not specified
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.