This patch release fixes a security issue where a malicious user with administrator permissions could set the JWT Secret Key to a masked value like ********, making the JWTs predictable. Big thanks to Rapid7 and @M-GRV for the responsible disclosure, and to @M-GRV for the fix.
What's changed
- fix: Prevent malicious admin from changing JWT Secret Key to masked value. props @M-GRV
- chore: update Composer deps.
- ci: Test compatibility with WordPress 6.8.2.
Full Changelog: 0.4.3...0.4.4
Contributors
M-GRV