User Role Editor Pro

Version 4.66.4 — 27 October 2026

• Improved Core version: 4.66.3
• Improved Marked as compatible with WordPress version 7.2
• Improved Required PHP version increased up to 8.2
• Fixed Content view restrictions add-on: restricted posts were not excluded from the front-end posts lists (home page, search results, archives) and from other posts queries, which do not set a single post type: post type is not set at all, set as an array of post types or as 'any'. The check "restrictions are applied to the public custom post types only" added in version 4.63 skipped such queries. Now such queries are skipped only if all requested post types are registered non-public ones. A single post/page view is processed as before: the selected access error action is applied. Discovered and responsibly reported by Michael LaRue.
• Fixed Content view restrictions add-on: the access error action set for a role/user was not loaded under PHP 8, when a post was blocked at the roles level: a string constant was compared with 0 instead of the current access error action value. URE_Content_View_Restrictions::get_access_error_action() returned 0, and the redirect access error action set via the 'ure_content_view_access_data_for_user' or 'ure_content_view_access_data_for_role' filter was not applied. Reported by Michael LaRue.
• New "Current user Media only" option. Turn it on at Settings > Additional Modules, then tick "Current user Media only" in the "Additional Options" section of the role editor for any role: users with that role see only the media items they uploaded themselves in the Media Library (wp-admin only; administrators are not restricted). Use the 'ure_attachments_show_full_list' filter (return true) to show the full list in a custom context.
• New Brazilian Portuguese (pt_BR) translation was added. Thanks to Jayron Castro.
• Fixed Admin menu access add-on: Remove only menu items, which submenu was emptied as blocked by URE itself. Some plugins/themes (e.g. Hello Elementor) intentionally remove all their submenu items at 'admin_head' to show a top level menu item only, and URE Pro removed such top level menu item.
• Improved Admin menu access add-on: the code which applies admin menu restrictions was moved to the separate URE_Admin_Menu_Access_Restrict class, which is not loaded for superadmin at all, as URE Pro does not restrict superadmin. URE_Admin_Menu_Access class keeps the code required for every user: Admin Menu access UI, admin menu copy update.
• Fixed Admin menu access add-on: a top level menu item, which is a submenu item for administrator (the admin menu copy is made for administrator), was not removed from menu when blocked (not allowed) for another role. Example: Wordfence "Login Security" page is a submenu item under "Wordfence" for users with 'activate_plugins' capability and a top level menu item for other users. Now restrictions set for the submenu item are applied to such top level menu item too.
• Fixed Several labels on the "About" box ("User Role Editor", "User Role Editor Pro", "Version:", "Plugin URL:", "Download URL:", "Author:", "Send support question") and the "Reset User Roles" heading at the Settings > Tools tab were hardcoded in English and could not be translated. The misspelled "Dowload URL:" label was corrected to "Download URL:".
• Improved "Admin Menu", "Gravity Forms Access", "Meta Boxes", "Nav Menus", "Other Roles", "Plugins", "Posts Edit" and "Widgets Admin" add-ons dialogs JavaScript: the own copy of the AJAX request success handler, identical to the core one, was removed; the core ure_main.update_success() is used instead.
• Improved Admin menu access add-on: unused code was removed from URE_Admin_Menu_Copy::get_submenu(): it added the "Profile" item to a local copy of the admin menu, which was not used. URE_Admin_Menu_Copy::get_menu() adds this item to the admin menu copy.
• Fixed Multisite: only the first 100 sites of a network were processed when a role change was applied to all sites of the network, network add-ons data was replicated, a role was imported to all sites, and plugin data was cleaned up on uninstall, as get_sites() (used by URE_Base_Lib::get_blog_ids() since version 4.66) returns 100 sites max by default.
• New 'ure_get_blog_ids_args' filter allows to exclude archived, spam and deleted sites from the list of network sites processed by the plugin (e.g. when a role change is applied to all sites of the network). Return an array with any of 'archived', 'spam', 'deleted' keys set to 0 (exclude such sites) or 1 (process such sites only), e.g. array( 'archived' => 0, 'spam' => 0, 'deleted' => 0 ). Other get_sites() arguments are ignored. Plugin data cleanup on uninstall always processes all sites.

Earlier versions

• 4.66.3 (25 September 2026): 2 fixed, 1 security
• 4.66.2 (15 September 2026): 1 fixed
• 4.66 (25 August 2026): 17 improved, 15 fixed, 2 security