User Role Editor Pro 4.66.1

User Role Editor Pro version 4.66.1 was published on September 15, 2026. It is mainly a security and bug-fix update that also brings a few UI improvements to the role editor.

Changes List

• Core version: 4.66.2
• Security: Broad output-escaping, input-sanitization, and SQL-query-preparation hardening pass across the Pro-only code, following a full WordPress.org Plugin Check audit.
• Fix: A late static binding bug in URE_Core::valid_php_version()/valid_wordpress_version() (self:: instead of static::) silently ignored Pro’s overridden minimum required WordPress version.
• Fix: “Other Roles Access” and “Posts Edit Access” add-ons used an invalid SQL placeholder that quoted an already-prepared, comma-separated ID list as a single string, silently breaking the “exclude users with blocked roles” admin filtering and the “auto-assign default term” logic for new posts.
• Fix: Three strings across the “Widgets Show/Admin Access” and “Front-End Menu Access” add-ons used a mistyped text domain, so they were never translated.
• Fix: “Widgets Admin Access” add-on called an internal-use-only WordPress function; replaced with a safe equivalent.
• Fix: “Front-End Menu Access” add-on was missing a check on a submitted menu item value.
• Fix: Multisite role import now checks the target site actually exists before querying its data, instead of relying on a raw database error for a nonexistent site.
• Update: Redirects to same-site URLs now use wp_safe_redirect(); deprecated/discouraged PHP and WordPress function calls (get_terms(), parse_url(), unlink(), date()) were replaced with their recommended equivalents across several add-ons.
• Fix: Posts edit access add-on: Selected post types were not saved at user profile.
• Update: Core version was updated to 4.66.2
• Fix: “Add Role” dialog kept showing the previously entered Role name (ID) and Display Role Name after a role was added, instead of blank fields.
• Update: “Delete Role” dialog now lists deletable roles in a checkbox table (Role Name / Role ID columns) instead of a single-select dropdown, so multiple roles can be deleted in one action; the old “Delete All Unused Roles” option is replaced by a “select all” checkbox in the table header.
• Update: “Delete Capability” dialog now has a “Quick Filter” text field next to its “select all” checkbox, to narrow down the capability list the same way the main page’s “Quick filter” field does.
• Update: The multisite “Allow non super administrators to create, edit, and delete users” option is narrowed to “Allow non super administrators to edit users”. The “create” part duplicated WordPress core’s own “Allow site administrators to add new users to their site via the ‘Users -> Add User’ page” network setting, and the “delete” part granted a capability that WordPress core never actually lets a single site administrator exercise (user deletion is blocked outside Network Admin regardless of capability) – both are dropped, along with the temporary superadmin-impersonation workaround they relied on.
• Update: Plugin’s own core JavaScript files (ure.js, settings.js, users.js, user-profile-other-roles.js, users-grant-roles.js) now have minified .min.js builds, generated with esbuild; each is enqueued via WordPress’s SCRIPT_DEBUG constant, same convention already used for the vendored notify.js/multiple-select.js (unminified source when SCRIPT_DEBUG is on, minified build otherwise).
• Update: Plugin’s own core CSS (css/ure-admin.css) now has a minified .min.css build, generated with esbuild; it’s enqueued via WordPress’s SCRIPT_DEBUG constant, same convention already used for the plugin’s own JS files (unminified source when SCRIPT_DEBUG is on, minified build otherwise).
• Update: js/users-grant-roles.js’s loose global functions (Grant Roles dialog, Add/Revoke role buttons on the Users page) were consolidated into a single URE_Users_Grant_Roles object.
• Update: Replaced the deprecated jQuery .click()/.click(fn) event-binding shorthand with .on(‘click’, fn) in users-grant-roles.js and users.js, clearing a jQuery Migrate deprecation warning on the Users page.
• Update: js/users.js’s loose global functions (the “Without role” button’s dialog on the Users page) were consolidated into a single URE_No_Role_Users object; the button’s onclick markup in URE_Assign_Role::show_html() was updated to match.
• Update: js/user-profile-other-roles.js’s loose global functions (the user profile “Other Roles” multi-select control) were consolidated into a single URE_User_Profile_Other_Roles object.
• Update: js/settings.js’s loose global functions (the Settings page’s “Reset User Roles” confirmation dialog) were consolidated into a single URE_Settings object.