= [4.67] 04.11.2026 =
* Core version: 4.67
* Security fix (core): Users page: Change Role, Grant Role, Add Role: a user with the “promote_users” capability could grant themselves (or others) roles with capabilities beyond their own, when custom high-privilege roles existed on the site. Role assignment now requires that the acting user already holds all critical capabilities of the target role; self-assignment of roles is no longer allowed. Thanks to Ahmed Mahmoud (Haktrak Networks) for the responsible disclosure.
* New (core): custom filter ‘ure_get_critical_capabilities’ allows to modify the list of critical capabilities used for the role assignment check. ‘manage_options’, ‘activate_plugins’, ‘delete_plugins’, ‘edit_users’, ‘delete_users’ capabilities are under control by default.
* Fix (core): “Without role” button on the Users page stopped working (showed “Please select at least one item to perform this action on.” after role selection).
* Update (core): allow users with only the ‘promote_users’ capability to use the “Without role” button.
* Update: the site URL (the ‘siteurl’ option value) is sent to the URE Pro update server with update checking/download request.
= [4.66.4] 27.10.2026 =