Release v4.67
User Role Editor Pro v4.67
Latest versionWhat's new in v4.67
User Role Editor Pro v4.67 was released on . Are you satisfied with standard WordPress roles list or user capabilities distribution among them? See the full changelog below and compare with the complete version history.
Release details
Released
731.3 KB
File available
Changelog
Other
- Core version: 4.67
- Security fix (core): Users page: Change Role, Grant Role, Add Role: a user with the "promote_users" capability could grant themselves (or others) roles with capabilities beyond their own, when custom high-privilege roles existed on the site. Role assignment now requires that the acting user already holds all critical capabilities of the target role; self-assignment of roles is no longer allowed. Thanks to Ahmed Mahmoud (Haktrak Networks) for the responsible disclosure.
Added
- (core): custom filter 'ure_get_critical_capabilities' allows to modify the list of critical capabilities used for the role assignment check. 'manage_options', 'activate_plugins', 'delete_plugins', 'edit_users', 'delete_users' capabilities are under control by default.
Fixed
- (core): "Without role" button on the Users page stopped working (showed "Please select at least one item to perform this action on." after role selection).
Improved
- (core): allow users with only the 'promote_users' capability to use the "Without role" button.
- the site URL (the 'siteurl' option value) is sent to the URE Pro update server with update checking/download request.
Compatibility
- Requires WordPress
- 4.7
- Tested up to
- 7.2
- Requires PHP
- 8.2
Verified safe
User Role Editor Pro v4.67 scanned clean with no security threats detected.
View full scan report