Home › View all posts by Vladimir

Author: Vladimir

User Role Editor Pro 4.66.4

Posted on by

User Role Editor Pro version 4.66.4 was published at October 27th, 2026. It fixes Content View Restrictions, which were leaking restricted posts into home page, search and archive lists. It adds a “Current user Media only” option and a Brazilian Portuguese translation, and fixes Admin Menu Access for Hello Elementor theme and Wordfence plugin. It also fixes multisite networks where only the first 100 sites were processed, and requires PHP 8.2+. It is tested up to WordPress 7.2.
Read more User Role Editor Pro 4.66.4 ›

User Role Editor 4.66

Posted on by

User Role Editor Pro version 4.66 was pulished at August 25, 2026. It mainly technical update, which better follows PHP and WordPress coding and security standards.

Changes List

  • Core version: 4.66.1
  • Update: Marked as compatible with WordPress 7.1
  • Update: Required PHP version increased up to 7.4
  • Update: Plugin loading code is enhanced.
  • Update: Plugin does not use self-defined PHP global constants. Needed data moved inside classes.
  • Update: “Admin menu access” add-on: White list of URL arguments allowed by default for WooCommerce products and shop orders list pages was updated.
  • Fix: URE_Assign_Role_Pro::get_users_queued() referenced an undefined constant instead of self::CRON_ACTION_HOOK.
  • Fix: URE_Assign_Role_Pro::assign_role_to_user() used a loose in_array() check against $user->caps that was always true, so the background role-assignment feature never actually assigned the role; now correctly checks $user->roles.
  • Fix: “Posts Edit Access” bulk action’s user ID list could contain stray whitespace instead of clean integers; user IDs are now properly cast to int.
  • Update: URE_Uninstall_Pro::init_options_list() now references addon classes own *_KEY constants instead of duplicating their option name strings.
  • Fix: Activating Pro while the free plugin was already active still left both active in some load orders, because URE_Core_Pro::init() (which registered the fix above) was itself skipped when the free plugin had already defined URE_Loader/URE_Core earlier in the same request; the activation-hook registration now happens unconditionally via a standalone function in the main plugin file.
  • Update: Core version was updated to 4.66.1
  • Update: URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.
  • Security Fix: SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.
  • Security Fix: URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.
  • Fix: URE_Protect_Admin used a bitwise “&” instead of a logical “&&” when checking a capabilities array, which could throw a PHP 8 TypeError; fixed to use “&&”, and the related IN() SQL clause is now hardened with array_map(‘absint’, …).
  • Update: Nonce actions used on the Settings/Tools pages are now scoped per form (ure_settings_update, ure_addons_settings_update, ure_default_roles_update, ure_settings_ms_update, ure_settings_tools_exec) instead of one shared string.
  • Update: Additional output escaping was added across URE_View, URE_Role_View and URE_Role_Additional_Options (role/capability slugs, wp_json_encode() instead of json_encode(), esc_url() on form actions), plus a defense-in-depth capability check in URE_Role_Additional_Options::save().
  • Update: rel=”noopener noreferrer” was added to external links opened with target=”_new”.
  • Update: Hardcoded text strings in the role editor toolbar are now translatable.
  • Fix: URE_Assign_Role used the %i SQL placeholder, which needs WordPress 6.2+, below the plugin’s declared minimum; replaced with direct interpolation of internal table names.
  • Fix: URE_Editor::reset_user_roles() had an unescaped wp_die() message; further output escaping (esc_url(), esc_html(), absint()) was added across URE_Base_Lib, URE_Editor, URE_User_Other_Roles and URE_User_View.
  • Fix: Several request-var/database-result comparisons that could be bypassed by PHP type juggling are now strict, including URE_Grant_Roles::is_try_remove_admin_from_himself()’s “can’t remove your own admin role” check.
  • Fix: URE_Base_Lib::set() now correctly rejects unknown properties instead of silently creating them; URE_View declares its $advert property explicitly.
  • Update: $_SERVER[‘REQUEST_URI’] is now validated and unslashed before sanitizing in URE_Lib::is_right_admin_path() and URE_User_Other_Roles::is_user_profile_extention_allowed().
  • Update: Posted role IDs are now sanitized (sanitize_key(), wp_unslash()) in URE_Editor, and its ‘object’/role-selection request parameters are constrained to known values.
  • Update: URE_Base_Lib::get_blog_ids() now uses get_sites() instead of a raw database query.
  • Update: URE_Capability::revoke_caps() now uses get_users() instead of a raw database query.
  • Update: URE_Protect_Admin::has_administrator_role() now uses user_can() instead of a raw database query.
  • Fix: URE_Assign_Role::$lib property was changed to protected.
  • Fix: URE_Uninstall::delete_options() private function changed to protected.
  • Fix: URE_Uninstall::init_options_list() referenced ‘ure_task_queue’, which never matched URE_Task_Queue::OPTION_NAME (‘ure_tasks_queue’), so that option was never deleted on uninstall.
  • Fix: URE_Core::define_files() – class URE_Uninstall was not added correctly, null was written instead of class name.
  • Fix: Activating Pro while the free version was already active caused a fatal “Cannot redeclare ure_log_error()” error; the function declaration is now guarded with function_exists().
  • Fix: Activating this plugin while the paired Pro plugin was already active silently left both active instead of deactivating the paired one, because the register_activation_hook() call never ran in that request; it’s now registered as a standalone function directly in the main plugin file, ahead of the class_exists(‘URE_Loader’) guard that was skipping it.