Summary
Recommended security update for all users. This release strengthens permission checks throughout WPeMatico, protecting plugin settings, tools, system information, and internal actions from unauthorized access.
Security
- Hardened permission checks on the plugin settings, Tools, and System Status screens. Importing and exporting settings, saving plugin settings, using Danger Zone options, and downloading system information now verify the current user’s capabilities in addition to the existing security nonce validation.
- WPeMatico internal actions now require the appropriate capability for the action being performed. Add-ons can also declare the capability required by their own actions through the new
wpematico_action_capabilityfilter. - Settings imports are now restricted to WPeMatico and its active add-ons. Invalid settings files are rejected instead of being processed, and the list of importable options can be extended through the new
wpematico_importable_option_keysfilter.
Improved
- Clearer and translatable messages are now displayed when a user does not have permission to perform an action.
Recommendation
Recommended for all users — update as soon as possible. This release focuses on strengthening permissions and security across WPeMatico’s administrative tools and internal actions.