User Role Editor Pro

Versión 4.66.3 — 24 septiembre 2026

• Seguridad Security Fix: administrator-role protection (URE_Protect_Admin::exclude_admin_role()) only excluded the "administrator" role from the assignable-roles list on the classic user edit screens, not on the plugin's own admin-ajax.php actions; a user holding the "promote_users" capability (without the plugin's own key capability) could therefore grant themselves or another user the "administrator" role via the "Add Role"/"Grant Roles" AJAX action, bypassing the same protection the classic Users screen correctly enforced. Discovered and responsibly reported by Humberto (SVO, https://svo.com.br).
• Corregido The "Grant Roles" dialog's AJAX request (get_grant_roles) incorrectly required the plugin's own key capability instead of "promote_users", refusing users who only had "promote_users" - the capability the Grant Roles feature is designed for - with an "Insufficient permissions" error.
• Corregido "Posts Edit Access" add-on: a user restricted (Allow model) to a specific category, post ID list, or author no longer could create a new post/page once they already had at least one matching item, because the "just clicked Add New" bypass in URE_Posts_Edit_Access::block_edit_post() only recognized the classic-editor save request, not the plain page load that immediately follows creating the new auto-draft; the brand-new post, having no category/author of its own yet, then failed the restriction check like any other non-matching item.

Versiones anteriores

• 4.66.2 (14 septiembre 2026): 1 corregido
• 4.66 (24 agosto 2026): 17 mejorado, 15 corregido, 2 seguridad
• 4.65 (20 mayo 2026): 6 mejorado