User Role Editor 4.66.3 was published at September 25, 2026. It’s the security and bug fix release.
Changes List
Core version: 4.66.2
- Security Fix: administrator-role protection (URE_Protect_Admin::exclude_admin_role()) only excluded the “administrator” role from the assignable-roles list on the classic user edit screens, not on the plugin’s own admin-ajax.php actions; a user holding the “promote_users” capability (without the plugin’s own key capability) could therefore grant themselves or another user the “administrator” role via the “Add Role”/”Grant Roles” AJAX action, bypassing the same protection the classic Users screen correctly enforced. Discovered and responsibly reported by Humberto (SVO, https://svo.com.br).
- Fix: the “Grant Roles” dialog’s AJAX request (get_grant_roles) incorrectly required the plugin’s own key capability instead of “promote_users”, refusing users who only had “promote_users” – the capability the Grant Roles feature is designed for – with an “Insufficient permissions” error.
- Fix: “Posts Edit Access” add-on: a user restricted (Allow model) to a specific category, post ID list, or author no longer could create a new post/page once they already had at least one matching item, because the “just clicked Add New” bypass in URE_Posts_Edit_Access::block_edit_post() only recognized the classic-editor save request, not the plain page load that immediately follows creating the new auto-draft; the brand-new post, having no category/author of its own yet, then failed the restriction check like any other non-matching item.
