4.6.0

Full Changelog

Added

• Add support for Wordpress 'reauth' #877 (PeterGFernandez)

Changed

• PHP 8.0+ compatibility improvements #878 (PeterGFernandez)
• Remove Initial Setup Wizard #886 (evansims)

---

You can verify the signature of a downloaded release archive using OpenSSL. Download the public signing key from the GitHub repository and save it to the same directory as the .ZIP and .SIGN files provided with this release, then run the following:

openssl dgst -verify public-signing-key.pub -keyform PEM -sha256 -signature Auth0_WordPress_Plugin_4.6.0.zip.sign -binary Auth0_WordPress_Plugin_4.6.0.zip

5.2.0

Added

• feat(SDK-4734): Implement support for Back-Channel Logout #882 (evansims) ¹

Changed

• Bumped auth0-php dependency version range to ^8.10.
• Raised the minimum supported PHP version to 8.1.
• Confirmed support for WordPress 6.4. Updated metadata to reflect support.

Note

¹ To use this feature, an Auth0 tenant must have support for it enabled.

5.1.0

Added

• Organization Name support was added for Authentication API and token handling ¹

Updated

• Bumped tested WordPress version to 6.3.0.
• Bumped auth0-php dependency version range to ^8.7.
• Updated telemetry to indicate wordpress package (previously wp-auth0.)

Note
¹ To use this feature, an Auth0 tenant must have support for it enabled. This feature is not yet available to all tenants.

4.5.0

Full Changelog

Added

• Cookie domain configuration to Advanced Options. #864 (evansims)
• Option to disable plugin logging. #848 (adamstraube)

Fixed

• auth0_update_meta filter not passing $value #847 (QWp6t)
• wpa0_should_create_user filter not registering with correct parameter count #843 (alyxb)

---

You can verify the signature of a downloaded release archive using OpenSSL. Download the public signing key from the GitHub repository and save it to the same directory as the .ZIP and .SIGN files provided with this release, then run the following:

openssl dgst -verify public-signing-key.pub -keyform PEM -sha256 -signature Auth0_WordPress_Plugin_4.5.0.zip.sign -binary Auth0_WordPress_Plugin_4.5.0.zip

5.0.1

Full Changelog

Fixed

• Resolves an issue which sometimes prevented the plugin from being activated on WordPress 6

5.0.0

Full Changelog

Introducing V5 of WP-Auth0 ("Login by Auth0"), a major redesign and upgrade to our WordPress integration plugin. V5 includes many new features and changes:

• WordPress 6 and PHP 8 support
• Integration with the Auth0-PHP SDK, and access to its entire API (including Management API calls)
• High performance background sync using WordPress' Cron feature
• "Flexible identifier" support, allowing users to sign in using multiple connection types without requiring extra configuration
• Expanded control over how sign ins without matching existing WordPress accounts are handled
• Enhanced session pairing between WordPress and Auth0, including session invalidation, access token refresh, and more.

V5 represents a major step forward for our WordPress plugin, and we're excited to see what you build with it!

It's important to note, if you wrote custom theme code or plugins for your WordPress site that targeted previous versions of the plugin, you may need to adjust those themes or plugins to adapt to the new version. We will be rolling this release out to the WordPress plugin store in the near future. Meanwhile, you can manually install the package using Composer using the instructions in the README.

5.0.0 BETA1

⚠️ Version 5.0 of our plugin is now available in Beta. This release adds a significant number of features, and includes breaking changes. We do not recommend using this release in a production environment yet, but your feedback and testing is appreciated.

New Features

• PHP 8.0 Support — The plugin has been redesigned to use PHP 8.0+ language features.
• Flexible Connection Matching — This allows users to sign in using multiple connections to the same account. For example, with this you can now sign in using your standard email-password, or social connections you've enabled. Any connection works so long as the authenticating account shares the same (verified) email address.
• Absentee Account Handling — You can now choose different behaviors for handling when a user signs in successfully, but an account doesn't exist matching the email. Although Auth0 Database Connections have always handled this well on the API side with the 'Disable Sign-Ups' toggle, social connections are trickier in cases where that option doesn't exist. You can now choose to deny those types of authentication requests, or dynamically create new accounts for those users.
• WP-Cron support — The plugin now leverages the WP background task scheduler to improve performance. Because real-time Management API calls can sometimes fail (rate limits, network congestion on one's hosting provider, etc.) we can now batch changes for WP customers with high traffic sites to more efficiently bring their CMS and Auth0 databases in sync.
• Session Pairing — WordPress sessions are not completely managed by the plugin, ensuring scenarios like token expiration and refresh tokens are honored and properly acted upon.
• PSR-18, PSR-17 and PSR-7 Support — All networking functions of the plugin have been rewritten to use the PHP-FIG standards for HTTP messaging. This also removes the library's dependency on Guzzle.
• WP_Object_Cache support — Caching now uses the native WP_Object_Cache API, for enhanced storage options through third-party plugins. In particular, this is now used for JWKS caching, enabling improved performance.

Breaking Changes

• PHP 8.0.0 is now the minimum supported version.
• Embedded login support has been deprecated, and Universal Login is now required.
• All auth0_ and a0_ prefixed functions have migrated into classes beneath the Auth0\WordPress namespace.
• All previous JWT processing using third-party libraries has been removed. This is now handled by Auth0's PHP SDK.
• Auth0\WordPress\Plugin handles the underlying Auth0-PHP SDK initialization and configuration.
• Auth0\WordPress\Actions\Authentication now handles all authentication functions, and acts as the core for the various WordPress hooks used throughout the system.
• Auth0\WordPress\Actions\Configuration now handles all Admin UI rendering functions. A new configuration database storage format has been established which will supersede the previous V4 method.
• Auth0\WordPress\Actions\Sync manages the new WP-Cron scheduled task functions.
• Sessions have been reworked to support the new Auth0 PHP SDK 8.0+ format.

Additional new features and changes may be added before this new version is released as stable.

5.0.0-BETA0

⚠️ Version 5.0 of our plugin is now available in Beta. This release adds a significant number of features. We do not recommend using this release in a production environment yet. There are breaking changes and some functionality remaining to be implemented. In particular, the migration process needs further development and testing. As we move toward General Availability, please be aware that further beta releases may contain additional breaking changes.

A new Beta Channel version of the plugin will be available from the WordPress plugin marketplace soon, which will enable you to opt into receiving updates to new development releases as they happen.

New Features

• PHP 8.0 Support — The plugin has been redesigned to use PHP 8.0+ language features.
• Flexible Connection Matching — This allows users to sign in using multiple connections to the same account. For example, with this you can now sign in using your standard email-password, or social connections you've enabled. Any connection works so long as the authenticating account shares the same (verified) email address.
• Absentee Account Handling — You can now choose different behaviors for handling when a user signs in successfully, but an account doesn't exist matching the email. Although Auth0 Database Connections have always handled this well on the API side with the 'Disable Sign Ups' toggle, social connections are trickier in cases where that option doesn't exist. You can now choose to deny those types of authentication requests, or dynamically create new accounts for those users.
• WP-Cron support — The plugin now leverages the WP background task scheduler to improve performance. Because real time Management API calls can sometimes fail (rate limits, network congestion on ones hosting provider, etc.) we can now batch changes for WP customers with high traffic sites to more efficiently bring their CMS and Auth0 databases in sync.
• Session Pairing — WordPress sessions are not completely managed by the plugin, ensuring scenarios like token expiration and refresh tokens are honored and properly acted upon.
• PSR-18, PSR-17 and PSR-7 Support — All networking functions of the plugin have been rewritten to use the PHP-FIG standards for HTTP messaging. This also removes the library's dependency on Guzzle.
• WP_Object_Cache support — Caching now uses the native WP_Object_Cache API, for enhanced storage options through third party plugins. In particular, this is now used for JWKS caching, enabling improved performance.

Breaking Changes

• PHP 8.0.0 is now the minimum supported version.
• Embedded login support has been deprecated, and Universal Login is now required.
• All auth0_ and a0_ prefixed functions have migrated into classes beneath the Auth0\WordPress namespace.
• All previous JWT processing using third-party libraries has been removed. This is now handled by Auth0's PHP SDK.
• Auth0\WordPress\Plugin handles the underlying Auth0-PHP SDK initialization and configuration.
• Auth0\WordPress\Actions\Authentication now handles all authentication functions, and acts as the core for the various WordPress hooks used throughout the system.
• Auth0\WordPress\Actions\Configuration now handles all Admin UI rendering functions. A new configuration database storage format has been established which will supersede the previous V4 method.
• Auth0\WordPress\Actions\Sync manages the new WP-Cron scheduled task functions.
• Sessions have been reworked to support the new Auth0 PHP SDK 8.0+ format.

Additional new features and changes may be added before this new version is released as stable.

4.4.0

Full Changelog

Added

• Enable passing extra custom parameters to the New Universal Login #834 (evansims)
• Update tests to use PHPUnit 7 and Docker #835 (evansims)

Fixed

• Skip email sync with Auth0 when we know the update is coming from Auth0 #831 (drobin03)

4.3.1

Full Changelog

Fixed

• Update client configuration url for embedded logins #832 (evansims)