User Role Editor Pro 4.67 version 4.67 was published at November 4th, 2026. This release strengthens role management security by preventing authorized users from assigning themselves and others higher‑privilege roles.
Changes List
Core version: 4.66.3
- Security fix (core): Users page: Change Role, Grant Role, Add Role: a user with the “promote_users” capability could grant themselves (or others) roles with capabilities beyond their own, when custom high-privilege roles existed on the site. Role assignment now requires that the acting user already holds all critical capabilities of the target role; self-assignment of roles is no longer allowed. Thanks to Ahmed Mahmoud (Haktrak Networks) for the responsible disclosure.
- New (core): custom filter ‘ure_get_critical_capabilities’ allows to modify the list of critical capabilities used for the role assignment check. ‘manage_options’, ‘activate_plugins’, ‘delete_plugins’, ‘edit_users’, ‘delete_users’ capabilities are under control by default.
- Fix (core): “Without role” button on the Users page stopped working (showed “Please select at least one item to perform this action on.” after role selection).
- Update (core): allow users with only the ‘promote_users’ capability to use the “Without role” button.
- Update: the site URL (the ‘siteurl’ option value) is sent to the URE Pro update server with update checking/download request.