LW Enable

Enable WordPress features - SVG uploads and more.

Overview

Installation

composer require lwplugins/lw-enable

Or upload the lw-enable folder to /wp-content/plugins/ and activate through the Plugins menu.

Features

SVG Uploads

Allow SVG file uploads with comprehensive security sanitization:

• MIME type registration for SVG files
• Script/XSS detection and blocking
• XXE (XML External Entity) protection
• Event handler detection
• Obfuscation detection (Unicode/hex escapes, entity encoding)
• Automatic SVG dimension extraction (width/height and viewBox)
• 5MB file size limit
• Post-upload re-validation

Settings

Configure under LW Plugins > Enable. Each feature is a simple checkbox toggle. Currently available:

WP-CLI Commands

# List all features and their status
wp lw-enable list
 
# Enable a feature
wp lw-enable enable svg
 
# Disable a feature
wp lw-enable disable svg
 
# Enable all features at once
wp lw-enable enable-all
 
# Disable all features (restore defaults)
wp lw-enable disable-all

Available Features

AI Abilities

When used with LW Site Manager, the following abilities are available for AI agents. All abilities require manage_options capability. These abilities are only active when LW Site Manager is also installed and activated - no hard dependency.

lw-enable/get-options (readonly)

Retrieve the current state of all LW Enable feature toggles.

Method: GET

curl -u "user:app-password" \
  "https://example.com/wp-json/wp-abilities/v1/abilities/lw-enable/get-options/run"

Response:

{
  "success": true,
  "options": {
    "svg": true
  }
}

Available fields:

lw-enable/set-options (write)

Toggle one or more LW Enable features. Only the provided keys are updated; others remain unchanged.

Method: POST

curl -u "user:app-password" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "input": {
      "options": {
        "svg": true
      }
    }
  }' \
  "https://example.com/wp-json/wp-abilities/v1/abilities/lw-enable/set-options/run"

Response:

{
  "success": true,
  "message": "1 option(s) updated.",
  "options": {
    "svg": true
  }
}

Disabling SVG uploads:

curl -u "user:app-password" \
  -X POST -H "Content-Type: application/json" \
  -d '{"input": {"options": {"svg": false}}}' \
  "https://example.com/wp-json/wp-abilities/v1/abilities/lw-enable/set-options/run"

Permissions

FAQ

Is SVG upload safe?

The plugin performs comprehensive sanitization: script detection, XSS prevention, XXE protection, event handler blocking, and obfuscation detection. Only clean SVGs pass validation.

What is the maximum SVG file size?

5MB per file.