= [4.66] 25.08.2026 =
* Core version: 4.66.1
* Update: Marked as compatible with WordPress 7.1
* Required PHP version increased up to 7.4
* Update: Plugin loading code is enhanced.
* Update: Plugin does not use self-defined PHP global constants. Needed data moved inside classes.
* Update: “Admin menu access” add-on: White list of URL arguments allowed by default for WooCommerce products and shop orders list pages was updated.
* Fix: URE_Assign_Role_Pro::get_users_queued() referenced an undefined constant instead of self::CRON_ACTION_HOOK.
* Fix: URE_Assign_Role_Pro::assign_role_to_user() used a loose in_array() check against $user->caps that was always true, so the background role-assignment feature never actually assigned the role; now correctly checks $user->roles.,* Core version was updated to 4.66.1
* Update: URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.
* Security Fix: SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.
* Security Fix: URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.
* Fix: URE_Protect_Admin used a bitwise “&” instead of a logical “&&” when checking a capabilities array, which could throw a PHP 8 TypeError; fixed to use “&&”, and the related IN() SQL clause is now hardened with array_map(‘absint’, …).
* Update: nonce actions used on the Settings/Tools pages are now scoped per form (ure_settings_update, ure_addons_settings_update, ure_default_roles_update, ure_settings_ms_update, ure_settings_tools_exec) instead of one shared string.
* Update: additional output escaping was added across URE_View, URE_Role_View and URE_Role_Additional_Options (role/capability slugs, wp_json_encode() instead of json_encode(), esc_url() on form actions), plus a defense-in-depth capability check in URE_Role_Additional_Options::save().
* Update: rel=”noopener noreferrer” was added to external links opened with target=”_new”.
* Update: hardcoded text strings in the role editor toolbar are now translatable.