Release v4.66.3
User Role Editor Pro v4.66.3
What's new in v4.66.3
User Role Editor Pro v4.66.3 was released on . Are you satisfied with standard WordPress roles list or user capabilities distribution among them? See the full changelog below and compare with the complete version history.
Release details
Released
661.7 KB
File available
Changelog
Other
- Core version: 4.66.2
- Security Fix: administrator-role protection (URE_Protect_Admin::exclude_admin_role()) only excluded the "administrator" role from the assignable-roles list on the classic user edit screens, not on the plugin's own admin-ajax.php actions; a user holding the "promote_users" capability (without the plugin's own key capability) could therefore grant themselves or another user the "administrator" role via the "Add Role"/"Grant Roles" AJAX action, bypassing the same protection the classic Users screen correctly enforced. Discovered and responsibly reported by Humberto (SVO, https://svo.com.br).
Fixed
- the "Grant Roles" dialog's AJAX request (get_grant_roles) incorrectly required the plugin's own key capability instead of "promote_users", refusing users who only had "promote_users" - the capability the Grant Roles feature is designed for - with an "Insufficient permissions" error.
- "Posts Edit Access" add-on: a user restricted (Allow model) to a specific category, post ID list, or author no longer could create a new post/page once they already had at least one matching item, because the "just clicked Add New" bypass in URE_Posts_Edit_Access::block_edit_post() only recognized the classic-editor save request, not the plain page load that immediately follows creating the new auto-draft; the brand-new post, having no category/author of its own yet, then failed the restriction check like any other non-matching item.
Compatibility
- Requires WordPress
- 4.7
- Tested up to
- 7.2
- Requires PHP
- 8.2
Verified safe
User Role Editor Pro v4.66.3 scanned clean with no security threats detected.
View full scan report