Fixed

• fix: Enforce allow_fallback setting during authentication

Fixed

• Security fix: Resolve CVE-2026-34236

Fixed

• Security fix: Resolve CVE-2025-68129

Fixed

• Security fix: Resolve CVE-2025-58769

Fixed

• Security fix: Resolve CVE-2025-47275

Full Changelog

Fixed

• Resolved an issue with corrupted JSON payloads.

Changed

• Tested against WordPress 6.5.5 w/ PHP 8.3.
• Improved translated string handling.

Fixed

• Resolved issue with ?wle parameter handling.

Fixed

• Resolves an issue in which the fallback URI secret isn't shown. #903 (HPiirainen)
• Resolves a compatibility issue with changes in WordPress 6.5 causing invalidated sessions. (evansims)

Full Changelog

Added

• Add support for Wordpress 'reauth' #877 (PeterGFernandez)

Changed

• PHP 8.0+ compatibility improvements #878 (PeterGFernandez)
• Remove Initial Setup Wizard #886 (evansims)

You can verify the signature of a downloaded release archive using OpenSSL. Download the public signing key from the GitHub repository and save it to the same directory as the .ZIP and .SIGN files provided with this release, then run the following:

openssl dgst -verify public-signing-key.pub -keyform PEM -sha256 -signature Auth0_WordPress_Plugin_4.6.0.zip.sign -binary Auth0_WordPress_Plugin_4.6.0.zip

Added

• feat(SDK-4734): Implement support for Back-Channel Logout #882 (evansims) ¹

Changed

• Bumped auth0-php dependency version range to ^8.10.
• Raised the minimum supported PHP version to 8.1.
• Confirmed support for WordPress 6.4. Updated metadata to reflect support.