wp_update_post_meta: update a permitted custom field
Use this operation for an identified content field. Internal plugin storage, credentials, permission settings, script configuration and keys beginning with an underscore are excluded. An empty or omitted key never returns a metadata dump.
Arguments
| Argument | Required | Meaning |
|---|---|---|
post_id |
Yes | Target post ID |
key |
Yes | One permitted field key |
value |
Yes | New field value |
dry_run |
No | JSON true previews without writing |
Requirements
The authenticated user must be able to edit the target post and access this metadata. Writing also requires Allow content writes and the corresponding write scope.
A key must be a POM Theme custom field enabled for that content type, or a WordPress-registered field exposed through REST. The target must be supported content in this site. Site administrators can inspect field definitions in the native administration interface; do not guess internal keys.
Use and verify
- Identify the field from its supported native definition.
- Read that explicit key on the intended post.
- Preview the operation, apply it within the requested scope and read the field again.
WordPress sanitization and the installation's KSES HTML policy apply to the value, including strings inside structured fields. Read back the stored value; updated: false can mean it was already identical.
pom_ai_mcp_meta_denied means the key, target or metadata permission is outside this operation. Use dedicated tools for SEO, featured images, layouts and script assignment. A write gate or capability error requires the site owner to grant the intended access. Field changes are not a site-wide undo mechanism; retain the previous value when recovery matters.
Related: MCP security and access.