# Is it safe to let AI edit your WordPress site? | Respira > Every guarantee that stands between an AI assistant and your live WordPress site: a snapshot before each content write, approval before anything destructive… Source: https://www.respira.press/safe --- # Let AI work on your WordPress site. Keep the undo button. Respira is the controlled connection between an AI assistant—such as Claude or ChatGPT—and your WordPress site. It gives the assistant tools to inspect and edit the site, while keeping the important decisions with you: every content write starts with a snapshot, destructive actions wait for approval, and every action leaves a receipt. [Connect a WordPress site free](https://www.respira.press/pricing) [Scan a WordPress site for known vulnerabilities](https://www.respira.press/wordpress-vulnerability-scanner) no card required. your 7-day trial starts when you connect the first WordPress site. ![Layered paper plans preserve an original beneath a proposed change, connected by one emerald thread that pauses before the final step.](https://www.respira.press/safe/change-held-before-commit.webp) ## Check the vulnerability—and what it may have left behind Most [WordPress security](https://www.respira.press/skills/wordpress-security-review) advice stops at “keep everything updated.” That closes a known gap, but it does not remove an unfamiliar administrator, application password, plugin, or PHP file that may already have appeared. Respira checks both sides: whether WordPress is current, and whether the published signs of compromise are present. ![Two parallel paper paths: one closes a gap ahead while the other loops back to inspect an earlier layer.](https://www.respira.press/safe/two-things-to-check.webp) Advisories currently checked - **WordPress 28 October 2026 core security release (CVE-2026-119977, unauthenticated code execution during core updates, exploited in the wild)** CVE-2026-119977 [WordPress 7.1.4 release notes](https://wordpress.org/news/2026/10/wordpress-7-1-4/)[Version 7.1.4](https://wordpress.org/documentation/wordpress-version/version-7-1-4/)[Patchstack: every fix in 7.1.4, with the privilege each one needs](https://patchstack.com/articles/wordpress-7-1-4-security-release/)[NVD: CVE-2026-119977](https://nvd.nist.gov/vuln/detail/CVE-2026-119977)[CISA Known Exploited Vulnerabilities catalog (added 3 November 2026)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)[Picus Security: how the upgrade race works, and the server rule that closes it](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability)[WordPress.org current releases by branch](https://api.wordpress.org/core/version-check/1.7/) - **PHP 21 October 2026 security release (CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution in PHP itself)** CVE-2026-109618 · CVE-2026-109619 [php.net security advisory, 21 October 2026](https://www.php.net/archive/2026.php#2026-10-21-5)[WordPress.org: Critical PHP security release (no WordPress update required or planned)](https://wordpress.org/news/2026/10/critical-php-security-release/)[GHSA-w8hw-w9fx-j79w (CVE-2026-109618, RCE via OOM corruption)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)[GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, RCE via stale global state)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)[PHP 8 changelog, with every fixed release](https://www.php.net/ChangeLog-8.php) - **UpdraftCentral connection keys stolen from teamupdraft.com and used to install backdoors (October 2026)** [TeamUpdraft: Security incident, what customers need to know](https://teamupdraft.com/blog/security-incident-october-2026/)[Search Engine Journal: the fix versions and where to remove old keys](https://www.searchenginejournal.com/updraftplus-wordpress-plugin-security-breach-enables-backdoor-attacks/593909/)[UpdraftPlus on WordPress.org](https://wordpress.org/plugins/updraftplus/) - **Rank Math SEO PRO 3.0.123 was distributed with a backdoor (CVE-2026-111862)** CVE-2026-111862 [Rank Math: PRO 3.0.123 security incident, with every indicator](https://rankmath.com/kb/pro-3-0-123-security-incident/)[Patchstack record: Rank Math SEO PRO 3.0.123, embedded malicious code](https://patchstack.com/database/wordpress/plugin/seo-by-rank-math-pro/vulnerability/wordpress-rank-math-seo-pro-plugin-3-0-123-unauthenticated-embedded-malicious-code-vulnerability)[SecurityWeek: the supply chain attack](https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/) - **Bricksforge unauthenticated file upload to remote code execution (CVE-2026-85097, exploited in the wild)** CVE-2026-85097 [Patchstack: the flaw, the attacks and the indicators](https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/)[Wordfence record: Bricksforge <= 3.1.8.9, unauthenticated arbitrary file upload](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bricksforge/bricksforge-3189-unauthenticated-arbitrary-file-upload-via-temporaryfileuploads-parameter)[The Hacker News: exploitation in the wild](https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html) - **WordPress 6 October 2026 core security release** CVE-2026-66666 [WordPress 7.1.3 release notes](https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/)[Version 7.1.3](https://wordpress.org/documentation/wordpress-version/version-7-1-3/)[WordPress.org current releases by branch](https://api.wordpress.org/core/version-check/1.7/) - **WordPress 22 September 2026 core security release (CVE-2026-87902, unauthenticated file inclusion in page templates, exploited in the wild)** CVE-2026-87902 [WordPress 7.1.2 release notes](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)[Version 7.1.2](https://wordpress.org/documentation/wordpress-version/version-7-1-2/)[GHSA-7hp8-65ch-5whp, with every patched branch](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp) - **Admin Menu Editor Pro 2.35 and 2.36 were distributed with a backdoor** [Wordfence record: Admin Menu Editor Pro 2.35 - 2.36, Backdoored Software](https://www.wordfence.com/threat-intel/vulnerabilities/id/8898bae3-067c-4505-9a96-05b7a08d90c6)[BleepingComputer: the incident and the indicators](https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/) - **WordPress 17 September 2026 core security release (Click2Shell forced theme install, unauthenticated stored XSS)** CVE-2026-93485 [WordPress 7.1.1 release notes](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)[Version 7.1.1, with the full backport list](https://wordpress.org/documentation/wordpress-version/version-7-1-1/)[Click2Shell, the reported chain](https://pwn.ai/blog/click2shell) - **WordPress 12 August 2026 core security release (Author+ RCE via Imagick and Ghostscript)** CVE-2026-65640 [WordPress 7.0.4 release notes](https://wordpress.org/news/2026/08/wordpress-7-0-4-release/)[Version 7.0.4, with the full backport list](https://wordpress.org/documentation/wordpress-version/version-7-0-4/) - **WordPress August 2026 core security release (XSS2Shell login-screen XSS)** CVE-2026-64638 · CVE-2026-114570 [WordPress 7.0.3 release notes](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/)[Version 7.0.3, with the full backport list](https://wordpress.org/documentation/wordpress-version/version-7-0-3/) - **WordPress wp2shell pre-authentication RCE chain** CVE-2026-60137 · CVE-2026-63030 [WordPress 7.0.2 security release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/) - **WooCommerce Store API CSRF admin-account chain** [WooCommerce security advisory](https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/) - **Stripe for WooCommerce payment validation issue** [Stripe for WooCommerce advisory](https://developer.woocommerce.com/2026/07/14/advisory-stripe-for-woo-patch/) - **Pods unauthenticated privilege escalation via the pods\_admin AJAX router** CVE-2026-19598 [CVE-2026-19598 at NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-19598)[Wordfence advisory](https://www.wordfence.com/threat-intel/vulnerabilities/id/3628032a-3121-45a7-8a78-cfcd8ba6af2f)[Pods on WordPress.org](https://wordpress.org/plugins/pods/) [See what the scan checks, and what it misses](https://www.respira.press/wordpress-vulnerability-scanner) ## Six safeguards between AI and your live WordPress site These are not promises written into an AI prompt. They run inside the Respira plugin on your WordPress server, where they still apply if the assistant misunderstands a request. ### Restore any AI content edit without rebuilding the page Respira stores the previous state before it changes a page, post or layout, so going back is a restore rather than a rebuild. You can diff two snapshots to see exactly what moved, line by line, before deciding whether to keep it. A deleted page, post or media item goes to the trash with a snapshot and comes back with one restore. Plugin installs and removals, plugin updates outside the guarded update, WordPress core updates, user accounts, and deleted menus and terms are not snapshotted: your host's backup is the way back for those, which is why the destructive ones wait for your approval. `get_snapshot · diff_snapshots · restore_snapshot` ### Destructive WordPress changes wait for your approval Updating WordPress core, removing a user, deleting a plugin: each one halts and waits for you to approve it explicitly. The assistant cannot talk its way past this. The gate is in the plugin on your server, not in the model. `two-step approval, server side` ### Read-only mode lets AI inspect without editing Observe lets an assistant look at everything and change nothing. The read-only flag is enforced on each tool rather than described in a prompt, so a mislabelled tool cannot quietly escape it. `read_only enforced per tool` ### Edit a duplicate before publishing to the live page For risky work the assistant duplicates the page, edits the duplicate, and shows it to you. The live page is untouched until you approve the swap. Your visitors never see a draft in progress. `duplicate · approve · reject` ### Timed-out writes never publish twice If a request times out, a read can safely be retried and a write cannot. Respira retries a write only when the server states it is replay-safe. The alternative is publishing the same page twice and calling it success. `replay-safe retry only` ### An independent log records every AI action What ran, when, against which site, and whether it worked. Not a summary the assistant wrote about itself: the log the plugin recorded independently. `list_activity · audit receipts` ## From WordPress scan to approved fix, with a receipt Ask your AI assistant to check a connected site and Respira follows the same supervised path every time. 1. 01 ### Scan Respira reads the WordPress version, verifies core file checksums against the official ones, and checks the published indicators for known advisories. 2. 02 ### Know You get a plain answer per site: below the patch for its branch, patched, needs investigation, or not enough evidence to say. Never a score with no reasoning attached. 3. 03 ### Approve The fix arrives as a prompt you can read before it runs. Every core or plugin update inside it still asks you separately. 4. 04 ### Receipt Afterwards: the target URL, the versions, the checksums, what was covered, what was not, and the site fingerprint. Evidence you can hand to a client. ## What Respira cannot verify from inside WordPress Respira can inspect WordPress itself. It cannot inspect infrastructure and accounts that live outside WordPress, so those boundaries stay visible in every result. - A patched version does not prove a site was never compromised. It proves it cannot be taken the same way tomorrow. - Host cron jobs and web server access logs sit outside WordPress. Respira cannot see them, and says so instead of implying a clean bill of health. - Rotating passwords, salts and third-party API secrets happens outside Respira and has to be verified there. - Whether an unfamiliar administrator account is legitimate is a question only you can answer. Respira will surface it and refuse to guess. Respira reports coverage as partial when a scan is truncated, and marks anything it did not measure as not measured rather than clean. An unmeasured zero and a real zero are different facts, and mixing them is how a dashboard ends up reassuring somebody who is exposed. ## The same safety controls across 19 WordPress page builders Every builder stores its content differently, and a write that is safe in one is a corrupted layout in another. The snapshot, approval and receipt guarantees are not per-builder features bolted on; they sit underneath all of them, which is why a rollback works the same whether the page was built in Elementor, Bricks, Divi or blocks. [Connect your first WordPress site](https://www.respira.press/pricing) [See how Respira works with AI](https://www.respira.press/features)