User Role Editor Pro v4.66.4 Plugin
User Role Editor is a WordPress plugin that allows users to easily edit and customize user roles and capabilities within WordPress. With the Pro version of the plugin, users can access a range of additional features that enhance the functionality of the plugin. These features include the ability to block selected admin menu items on a per-role basis, as well as the ability to show front-end menu items for different user types. Users can also block selected widgets and sidebars, as well as meta boxes, for specific roles.
Additionally, the plugin allows users to restrict access to other roles for selected roles, and to set per-plugin access for roles and users with “activate_plugins” capability. The plugin also allows users to export and import user roles, and provides multi-site capabilities that enable users to manage roles and users for all sites at the network admin level. Finally, the plugin provides content edit access restriction features, such as forcing all custom post types to use their own custom capabilities set and activating “Create” capability for posts/pages/custom post types. Users can also restrict access to Gravity Forms by forms ID list, and restrict users’ access to selected posts and pages based on their IDs, category/taxonomy IDs, or author user IDs.
Core Features of User Role Editor Pro Plugin
- Edit existing user roles and create new ones
- Add and remove capabilities to user roles
- Assign new roles and capabilities to individual users
- Block access to selected admin menu items on a per-role basis
- Control front-end menu item visibility for different user roles and login statuses
- Block access to selected widgets and sidebars on a per-role basis
- Block access to selected meta boxes (dashboard, posts, pages, custom post types) for roles
- Block access to other roles for a selected role
- Grant per-plugin access for roles and users with “activate_plugins” capability
- Export and import user roles
- Manage roles and users across multiple sites in a WordPress network from a single point
- Restrict access of single site administrators to selected user capabilities and add/delete role operations
- Restrict access to individual posts and pages by post/page ID, category/taxonomy ID, or author user ID
- Restrict access to Gravity Forms by form ID list
- Force custom post types to use their own custom capabilities set instead of using a built-in set
- Activate “Create” capability for posts/pages/custom post types to allow users to create new content
- Pro version is ad-free and offers additional features
What’s New (Changelog) in User Role Editor Pro v4.66.4
= [v4.66.4] 27.10.2026 =
* Core version: 4.66.3
* Update: Marked as compatible with WordPress version 7.2
* Update: Required PHP version increased up to 8.2
* Fix: Content view restrictions add-on: restricted posts were not excluded from the front-end posts lists (home page, search results, archives) and from other posts queries, which do not set a single post type: post type is not set at all, set as an array of post types or as 'any'. The check "restrictions are applied to the public custom post types only" added in version 4.63 skipped such queries. Now such queries are skipped only if all requested post types are registered non-public ones. A single post/page view is processed as before: the selected access error action is applied. Discovered and responsibly reported by Michael LaRue.
* Fix: Content view restrictions add-on: the access error action set for a role/user was not loaded under PHP 8, when a post was blocked at the roles level: a string constant was compared with 0 instead of the current access error action value. URE_Content_View_Restrictions::get_access_error_action() returned 0, and the redirect access error action set via the 'ure_content_view_access_data_for_user' or 'ure_content_view_access_data_for_role' filter was not applied. Reported by Michael LaRue.
* New: "Current user Media only" option. Turn it on at Settings > Additional Modules, then tick "Current user Media only" in the "Additional Options" section of the role editor for any role: users with that role see only the media items they uploaded themselves in the Media Library (wp-admin only; administrators are not restricted). Use the 'ure_attachments_show_full_list' filter (return true) to show the full list in a custom context.
* New: Brazilian Portuguese (pt_BR) translation was added. Thanks to Jayron Castro.
* Fix: Admin menu access add-on: Remove only menu items, which submenu was emptied as blocked by URE itself. Some plugins/themes (e.g. Hello Elementor) intentionally remove all their submenu items at 'admin_head' to show a top level menu item only, and URE Pro removed such top level menu item.
* Update: Admin menu access add-on: the code which applies admin menu restrictions was moved to the separate URE_Admin_Menu_Access_Restrict class, which is not loaded for superadmin at all, as URE Pro does not restrict superadmin. URE_Admin_Menu_Access class keeps the code required for every user: Admin Menu access UI, admin menu copy update.
* Fix: Admin menu access add-on: a top level menu item, which is a submenu item for administrator (the admin menu copy is made for administrator), was not removed from menu when blocked (not allowed) for another role. Example: Wordfence "Login Security" page is a submenu item under "Wordfence" for users with 'activate_plugins' capability and a top level menu item for other users. Now restrictions set for the submenu item are applied to such top level menu item too.
* Update: "Admin Menu", "Gravity Forms Access", "Meta Boxes", "Nav Menus", "Other Roles", "Plugins", "Posts Edit" and "Widgets Admin" add-ons dialogs JavaScript: the own copy of the AJAX request success handler, identical to the core one, was removed; the core ure_main.update_success() is used instead.
* Update: Admin menu access add-on: unused code was removed from URE_Admin_Menu_Copy::get_submenu(): it added the "Profile" item to a local copy of the admin menu, which was not used. URE_Admin_Menu_Copy::get_menu() adds this item to the admin menu copy.
* Fix (core): Multisite: only the first 100 sites of a network were processed when a role change was applied to all sites of the network, network add-ons data was replicated, a role was imported to all sites, and plugin data was cleaned up on uninstall, as get_sites() (used by URE_Base_Lib::get_blog_ids() since version 4.66) returns 100 sites max by default.
* New (core): 'ure_get_blog_ids_args' filter allows to exclude archived, spam and deleted sites from the list of network sites processed by the plugin (e.g. when a role change is applied to all sites of the network). Return an array with any of 'archived', 'spam', 'deleted' keys set to 0 (exclude such sites) or 1 (process such sites only), e.g. array( 'archived' => 0, 'spam' => 0, 'deleted' => 0 ). Other get_sites() arguments are ignored. Plugin data cleanup on uninstall always processes all sites.
Similar Plugins