Release v2.7
Secupress Pro v2.7
What's new in v2.7
Secupress Pro v2.7 was released on . Like many Security Plugins, SecuPress has a bunch of awesome features. See the full changelog below and compare with the complete version history.
Release details
Released
3.4 MB
File unavailable
Changelog
Other
- 12 Sep 2026
- Security Fix: Unauthenticated Authentication Bypass via 'secupress_auto_login_token' Parameter.
- Security Fix: Possible RCE when writing constants into wp-config.php.
- Security Fix: SQL Injection by administrators when deleting logs.
Added
- Pause the security for 30 minutes (settings kept, auto-resume, email warning).
- Dashboard widget "System Status".
- Alerts when an application password is added to an account.
- Expert settings for Anti Hotlink (allowed referers, redirection type, webp/avif/svg).
- Password protection for backup ZIP files.
Improved
- Application Passwords alerts are no longer enabled by default.
- Firewall updated to 8G (query, URI, host, cookie, user-agent, referer).
- Store backups outside the web root when possible.
- Strong passwords are now enforced on the password reset form. PasswordLess users cannot reset.
- Export/import restricted to configuration keys only (no logs, transients, scans, or banned IPs).
- HTTPS redirection now generates IIS rules.
- Compatibility fallbacks when the mbstring PHP extension is missing.
- Hide sensitive COOKIE values in block reports.
- Self-unban emails no longer leak whether an address exists.
- Updated forbidden file extensions list.
Fixed
- Rewrite rules and current URL for subdirectory, subdomain, siteurl and own-directory installs (readme.html, changelogs, bad URL/file access, Move Login).
- User enumeration via REST routes, language URL prefixes like /fr/, and ?_embed=.
- Possible PasswordLess bypass after last fix from Protect User Creation.
- (again) Possible fatal error "Call to undefined method ::is_processing()" if WooCommerce loads an older async lib (file monitoring, bad plugins, bad themes).
- Bad themes deactivation hooks.
- Unlock admin callback used a wrong message.
- A plugin returning to the repository was still listed as closed/old.
- Fake Google Bots filter.
- Wrong return type in rewrite bases helper.
- String/array issue in the database malware scan.
- Safely remove the PasswordLess option and fix the affected role check.
Compatibility
- Requires WordPress
- 5.5
- Tested up to
- 7.1.3
- Requires PHP
- 7.3
Verified safe
Secupress Pro v2.7 scanned clean with no security threats detected.
View full scan report