User Role Editor Pro WordPress plugin allows you to change user roles and capabilities easy.\nJust turn on check boxes of capabilities you wish to add to the selected role and click "Update" button to save your changes. That's done.\nAdd new roles and customize its capabilities according to your needs, from scratch of as a copy of other existing role.\nUnnecessary self-made role can be deleted if there are no users whom such role is assigned.\nRole assigned every new created user by default may be changed too.\nCapabilities could be assigned on per user basis. Multiple roles could be assigned to user simultaneously.\nYou can add new capabilities and remove unnecessary capabilities which could be left from uninstalled plugins.\nMulti-site support is provided.<\/p>", "installation": "
Installation procedure:<\/p>\n
In case you have a free version of User Role Editor installed:\nPro version includes its own copy of a free version (or the core of a User Role Editor). So you should deactivate free version and can remove it before installing of a Pro version.\nThe only thing that you should remember is that both versions (free and Pro) use the same place to store their settings data.\nSo if you delete free version via WordPress Plugins Delete link, plugin will delete automatically its settings data. Changes made to the roles will stay unchanged.\nYou will have to configure lost part of the settings at the User Role Editor Pro Settings page again after that.\nRight decision in this case is to delete free version folder (user-role-editor) after deactivation via FTP, not via WordPress.<\/p>", "changelog": "
Core version: 4.66.2<\/p>\n<\/li>\n
Fix: Opening the "Admin Menu", "Plugins", "Posts Edit", "Posts View", "Meta Boxes", "Widgets Admin", "Nav Menus", "Other Roles", "Gravity Forms Access" or "Import Role" dialog from the role editor toolbar threw a JavaScript "ure_ui_button_text is not defined" error and left the dialog's buttons unstyled, caused by the 4.66.1 core ure.js refactor renaming that helper to ure_main.ui_button_text() without updating these Pro-only add-on scripts.<\/p>\n
Core version: 4.66.2<\/p>\n<\/li>\n
Security: Broad output-escaping, input-sanitization, and SQL-query-preparation hardening pass across the Pro-only code, following a full WordPress.org Plugin Check audit.<\/p>\n<\/li>\n
Fix: A late static binding bug in URE_Core::valid_php_version()\/valid_wordpress_version() (self:: instead of static::) silently ignored Pro's overridden minimum required WordPress version.<\/p>\n<\/li>\n
Fix: "Other Roles Access" and "Posts Edit Access" add-ons used an invalid SQL placeholder that quoted an already-prepared, comma-separated ID list as a single string, silently breaking the "exclude users with blocked roles" admin filtering and the "auto-assign default term" logic for new posts.<\/p>\n<\/li>\n
Fix: Three strings across the "Widgets Show\/Admin Access" and "Front-End Menu Access" add-ons used a mistyped text domain, so they were never translated.<\/p>\n<\/li>\n
Fix: "Widgets Admin Access" add-on called an internal-use-only WordPress function; replaced with a safe equivalent.<\/p>\n<\/li>\n
Fix: "Front-End Menu Access" add-on was missing a check on a submitted menu item value.<\/p>\n<\/li>\n
Fix: Multisite role import now checks the target site actually exists before querying its data, instead of relying on a raw database error for a nonexistent site.<\/p>\n<\/li>\n
Update: Redirects to same-site URLs now use wp_safe_redirect(); deprecated\/discouraged PHP and WordPress function calls (get_terms(), parse_url(), unlink(), date()) were replaced with their recommended equivalents across several add-ons.<\/p>\n<\/li>\n
Fix: Posts edit access add-on: Selected post types were not saved at user profile.<\/p>\n<\/li>\n
Core version was update to 4.66.2<\/p>\n<\/li>\n
Fix: "Add Role" dialog kept showing the previously entered Role name (ID) and Display Role Name after a role was added, instead of blank fields.<\/p>\n<\/li>\n
Update: "Delete Role" dialog now lists deletable roles in a checkbox table (Role Name \/ Role ID columns) instead of a single-select dropdown, so multiple roles can be deleted in one action; the old "Delete All Unused Roles" option is replaced by a "select all" checkbox in the table header.<\/p>\n<\/li>\n
Update: "Delete Capability" dialog now has a "Quick Filter" text field next to its "select all" checkbox, to narrow down the capability list the same way the main page's "Quick filter" field does.<\/p>\n<\/li>\n
Update: The multisite "Allow non super administrators to create, edit, and delete users" option is narrowed to "Allow non super administrators to edit users". The "create" part duplicated WordPress core's own "Allow site administrators to add new users to their site via the 'Users -> Add User' page" network setting, and the "delete" part granted a capability that WordPress core never actually lets a single site administrator exercise (user deletion is blocked outside Network Admin regardless of capability) - both are dropped, along with the temporary superadmin-impersonation workaround they relied on.<\/p>\n<\/li>\n
Update: Plugin's own core JavaScript files (ure.js, settings.js, users.js, user-profile-other-roles.js, users-grant-roles.js) now have minified .min.js builds, generated with esbuild; each is enqueued via WordPress's SCRIPT_DEBUG constant, same convention already used for the vendored notify.js\/multiple-select.js (unminified source when SCRIPT_DEBUG is on, minified build otherwise).<\/p>\n<\/li>\n
Update: Plugin's own core CSS (css\/ure-admin.css) now has a minified .min.css build, generated with esbuild; it's enqueued via WordPress's SCRIPT_DEBUG constant, same convention already used for the plugin's own JS files (unminified source when SCRIPT_DEBUG is on, minified build otherwise).<\/p>\n<\/li>\n
Update: js\/users-grant-roles.js's loose global functions (Grant Roles dialog, Add\/Revoke role buttons on the Users page) were consolidated into a single URE_Users_Grant_Roles object.<\/p>\n<\/li>\n
Update: Replaced the deprecated jQuery .click()\/.click(fn) event-binding shorthand with .on('click', fn) in users-grant-roles.js and users.js, clearing a jQuery Migrate deprecation warning on the Users page.<\/p>\n<\/li>\n
Update: js\/users.js's loose global functions (the "Without role" button's dialog on the Users page) were consolidated into a single URE_No_Role_Users object; the button's onclick markup in URE_Assign_Role::show_html() was updated to match.<\/p>\n<\/li>\n
Update: js\/user-profile-other-roles.js's loose global functions (the user profile "Other Roles" multi-select control) were consolidated into a single URE_User_Profile_Other_Roles object.<\/p>\n<\/li>\n
Update: js\/settings.js's loose global functions (the Settings page's "Reset User Roles" confirmation dialog) were consolidated into a single URE_Settings object.<\/p>\n
Core version: 4.66.1<\/p>\n<\/li>\n
Update: Marked as compatible with WordPress 7.1<\/p>\n<\/li>\n
Required PHP version increased up to 7.4<\/p>\n<\/li>\n
Update: Plugin loading code is enhanced. <\/p>\n<\/li>\n
Update: Plugin does not use self-defined PHP global constants. Needed data moved inside classes.<\/p>\n<\/li>\n
Update: "Admin menu access" add-on: White list of URL arguments allowed by default for WooCommerce products and shop orders list pages was updated.<\/p>\n<\/li>\n
Fix: URE_Assign_Role_Pro::get_users_queued() referenced an undefined constant instead of self::CRON_ACTION_HOOK.<\/p>\n<\/li>\n
Fix: URE_Assign_Role_Pro::assign_role_to_user() used a loose in_array() check against $user->caps that was always true, so the background role-assignment feature never actually assigned the role; now correctly checks $user->roles.<\/p>\n<\/li>\n
Fix: "Posts Edit Access" bulk action's user ID list could contain stray whitespace instead of clean integers; user IDs are now properly cast to int.<\/p>\n<\/li>\n
Update: URE_Uninstall_Pro::init_options_list() now references addon classes own *_KEY constants instead of duplicating their option name strings.<\/p>\n<\/li>\n
Fix: activating Pro while the free plugin was already active still left both active in some load orders, because URE_Core_Pro::init() (which registered the fix above) was itself skipped when the free plugin had already defined URE_Loader\/URE_Core earlier in the same request; the activation-hook registration now happens unconditionally via a standalone function in the main plugin file.<\/p>\n<\/li>\n
Core version was updated to 4.66.1<\/p>\n<\/li>\n
Update: URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.<\/p>\n<\/li>\n
Security Fix: SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.<\/p>\n<\/li>\n
Security Fix: URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.<\/p>\n<\/li>\n
Fix: URE_Protect_Admin used a bitwise "&" instead of a logical "&&" when checking a capabilities array, which could throw a PHP 8 TypeError; fixed to use "&&", and the related IN() SQL clause is now hardened with array_map('absint', ...).<\/p>\n<\/li>\n
Update: nonce actions used on the Settings\/Tools pages are now scoped per form (ure_settings_update, ure_addons_settings_update, ure_default_roles_update, ure_settings_ms_update, ure_settings_tools_exec) instead of one shared string.<\/p>\n<\/li>\n
Update: additional output escaping was added across URE_View, URE_Role_View and URE_Role_Additional_Options (role\/capability slugs, wp_json_encode() instead of json_encode(), esc_url() on form actions), plus a defense-in-depth capability check in URE_Role_Additional_Options::save().<\/p>\n<\/li>\n
Update: rel="noopener noreferrer" was added to external links opened with target="_new".<\/p>\n<\/li>\n
Update: hardcoded text strings in the role editor toolbar are now translatable.<\/p>\n<\/li>\n
Fix: URE_Assign_Role used the %i SQL placeholder, which needs WordPress 6.2+, below the plugin's declared minimum; replaced with direct interpolation of internal table names.<\/p>\n<\/li>\n
Fix: URE_Editor::reset_user_roles() had an unescaped wp_die() message; further output escaping (esc_url(), esc_html(), absint()) was added across URE_Base_Lib, URE_Editor, URE_User_Other_Roles and URE_User_View.<\/p>\n<\/li>\n
Fix: several request-var\/database-result comparisons that could be bypassed by PHP type juggling are now strict, including URE_Grant_Roles::is_try_remove_admin_from_himself()'s "can't remove your own admin role" check.<\/p>\n<\/li>\n
Fix: URE_Base_Lib::set() now correctly rejects unknown properties instead of silently creating them; URE_View declares its $advert property explicitly.<\/p>\n<\/li>\n
Update: $_SERVER['REQUEST_URI'] is now validated and unslashed before sanitizing in URE_Lib::is_right_admin_path() and URE_User_Other_Roles::is_user_profile_extention_allowed().<\/p>\n<\/li>\n
Update: posted role IDs are now sanitized (sanitize_key(), wp_unslash()) in URE_Editor, and its 'object'\/role-selection request parameters are constrained to known values.<\/p>\n<\/li>\n
Update: URE_Base_Lib::get_blog_ids() now uses get_sites() instead of a raw database query.<\/p>\n<\/li>\n
Update: URE_Capability::revoke_caps() now uses get_users() instead of a raw database query.<\/p>\n<\/li>\n
Update: URE_Protect_Admin::has_administrator_role() now uses user_can() instead of a raw database query.<\/p>\n<\/li>\n
Fix: URE_Assign_Role::$lib property was changed to protected.<\/p>\n<\/li>\n
Fix: URE_Uninstall::delete_options() private function changed to protected.<\/p>\n<\/li>\n
Fix: URE_Uninstall::init_options_list() referenced 'ure_task_queue', which never matched URE_Task_Queue::OPTION_NAME ('ure_tasks_queue'), so that option was never deleted on uninstall.<\/p>\n<\/li>\n
Fix: URE_Core::define_files() - class URE_Uninstall was not added correctly, null was written instead of class name.<\/p>\n<\/li>\n
Fix: activating Pro while the free version was already active caused a fatal "Cannot redeclare ure_log_error()" error; the function declaration is now guarded with function_exists().<\/p>\n<\/li>\n
Fix: activating this plugin while the paired Pro plugin was already active silently left both active instead of deactivating the paired one, because the register_activation_hook() call never ran in that request; it's now registered as a standalone function directly in the main plugin file, ahead of the class_exists('URE_Loader') guard that was skipping it.<\/p>\n
Core version: 4.65<\/p>\n<\/li>\n
Update: Marked as compatible with WordPress 7.0<\/p>\n<\/li>\n
Update: Minor fixes to pages markup are applied to correspond WordPress 7.0 CSS changes. <\/p>\n<\/li>\n
Update: "defined('ABSPATH')"\u00a0guard was added to all PHP files to exclude PHP files direct execution. <\/p>\n<\/li>\n
Update: sanitize_text_field(), sanitize_key(), sanitize_url() functions are used to secure user input before processing.<\/p>\n<\/li>\n
Update: _nonce field checking was added before data update in addition checking made already on the higher level.<\/p>\n<\/li>\n
Core version was updated to 4.65<\/p>\n<\/li>\n
Fix: Users->User Role Editor->Import: single user role was imported successfully but the empty page was shown instead of URE page with successful import notification.<\/p>\n<\/li>\n
Fix: Meta Boxes Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Meta Boxes: current role does not lose now all capabilities after the 'Update' button click.<\/p>\n<\/li>\n
Fix: Other Roles Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Other Roles: current role does not lose now all capabilities after the 'Update' button click.<\/p>\n<\/li>\n
Fix: Posts Edit Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Posts Edit: current role does not lose now all capabilities after the 'Update' button click.<\/p>\n<\/li>\n
Fix: Plugins Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Plugins: current role does not lose now all capabilities after the 'Update' button click.<\/p>\n<\/li>\n
Fix: Export roles CSV download file with .pdf extension in the FireFox browser. Content type header was replaced to 'text\/plain'.<\/p>\n<\/li>\n
Update: Meta Boxes Access add-on: data is updated via AJAX without full page refresh now.<\/p>\n<\/li>\n
Update: Other Roles Access add-on: data is updated via AJAX without full page refresh now.<\/p>\n<\/li>\n
Update: Posts Edit Access add-on: data for role is updated without full page refresh via AJAX now.<\/p>\n<\/li>\n
Update: Plugins Access add-on: data is updated via AJAX without full page refresh now.<\/p>\n<\/li>\n
Update: Import role CSV: uploaded file .csv extention and mime type checking were added.<\/p>\n<\/li>\n
Update: "Users->User Role Editor->Import" button is hidden in case page is opened from the WP Multisite -> Network admin. Use it from the selected single site only.<\/p>\n<\/li>\n<\/ul>\n
Full list of changes is available in changelog.txt file.<\/p>" }, "last_updated": "2026-09-15 12:11:33", "slug": "user-role-editor-pro", "license_state": "invalid", "request_time_elapsed": "0.002" }