= v4.2.18 (21 September, 2026) =
Security – The user directory no longer shows a member’s email address or phone number to logged-out visitors; the columns stay in place and signed-in visitors still see the details
Security – The user directory preview used by the block editor now requires an editor account, and it returns only the public profile fields instead of the full member record
Security – A member’s full profile record, including their capabilities, is now only returned to the profile owner or a user who can manage users
Security – Applied the hardening from the 2026-07 security audit across the payment, invoice, private message, social login and form field screens: output is escaped, admin actions check permissions, and submitted values are cleaned before use