= [4.66.3] 25.09.2026 =
* Core version: 4.66.2
* Security Fix: administrator-role protection (URE_Protect_Admin::exclude_admin_role()) only excluded the “administrator” role from the assignable-roles list on the classic user edit screens, not on the plugin’s own admin-ajax.php actions; a user holding the “promote_users” capability (without the plugin’s own key capability) could therefore grant themselves or another user the “administrator” role via the “Add Role”/”Grant Roles” AJAX action, bypassing the same protection the classic Users screen correctly enforced. Discovered and responsibly reported by Humberto (SVO, https://svo.com.br).
* Fix: the “Grant Roles” dialog’s AJAX request (get_grant_roles) incorrectly required the plugin’s own key capability instead of “promote_users”, refusing users who only had “promote_users” – the capability the Grant Roles feature is designed for – with an “Insufficient permissions” error.
* Fix: “Posts Edit Access” add-on: a user restricted (Allow model) to a specific category, post ID list, or author no longer could create a new post/page once they already had at least one matching item, because the “just clicked Add New” bypass in URE_Posts_Edit_Access::block_edit_post() only recognized the classic-editor save request, not the plain page load that immediately follows creating the new auto-draft; the brand-new post, having no category/author of its own yet, then failed the restriction check like any other non-matching item.
= [4.66.2] 15.09.2026 =
* Core version: 4.66.2
* Fix: Opening the “Admin Menu”, “Plugins”, “Posts Edit”, “Posts View”, “Meta Boxes”, “Widgets Admin”, “Nav Menus”, “Other Roles”, “Gravity Forms Access” or “Import Role” dialog from the role editor toolbar threw a JavaScript “ure_ui_button_text is not defined” error and left the dialog’s buttons unstyled, caused by the 4.66.1 core ure.js refactor renaming that helper to ure_main.ui_button_text() without updating these Pro-only add-on scripts.