Security fixes go into the latest 1.x release of @mainwp/mcp. Before reporting, check that the problem is still
present in the newest release.
| Version | Supported |
|---|---|
| 1.x (latest) | Yes |
| Older 1.x releases | No |
| Pre-releases (alpha, beta) | No |
Please do not open a public issue for a security problem. Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability.
Include the package version, your MainWP Dashboard version, how the server is configured (with credentials removed), and the steps that reproduce the problem.
We aim to acknowledge a report within a few business days and keep you updated while we investigate. Once a fix ships, we publish an advisory and credit you unless you ask us not to.
This policy covers the MCP server in this repository. Vulnerabilities in the MainWP Dashboard or MainWP Child plugins should be reported to MainWP through https://mainwp.com/ instead.