WP Sudo 4.5.0 — Session Governance, Admin UX & Security Hardening

[dknauss]

Recommended security update. 4.5.0 bundles everything landed on main since
v4.2.2 — two completed milestones (v4.4.0 Two Factor Lifecycle Bridge and v4.5
Session Governance & Admin UX) plus two backward-compatible security-hardening
fixes. No migration required.

🔒 Security hardening

• Escalation-guard authority. The opt-in admin-escalation guard now requires
  the acting user to actually hold the promoting authority — promote_users for
  administrator grants (checked on the target blog) or existing super-admin for
  grant_super_admin — in addition to an active sudo session. Sudo is
  reauthentication, not authorization: a low-privilege account can hold a sudo
  session, so requiring the session alone could wave through an escalation
  reached via a broken-access-control route. Blocked grants still fire
  wp_sudo_escalation_blocked.
• Session-revocation token binding. Users-list session revocation (row action
  and the new bulk action) now requires the operator's token-bound sudo session,
  not just a live expiry timestamp. A stolen auth cookie — or a second session
  without its own sudo — can no longer revoke other users' sessions. Revoking
  several sessions in a row no longer forces a re-challenge between them.

✨ Session governance & admin UX

• Bulk session revocation. Revoking sessions is now a native "Revoke sudo
  sessions" entry in the Users-list Bulk actions dropdown (filter to the Sudo
  Active view, select, apply) — replacing the old toolbar button and its
  confirmation interstitial, mirroring core's password-reset bulk action. It
  enforces operator token-bound sudo, consumes one rate-limit slot per batch,
  skips your own row, and — hardening from external review — runs from a
  nonce-verified interceptor with a current-site membership guard, so forged user
  IDs can't revoke or probe other sites' sessions on multisite. Site-wide revoke
  remains available via wp sudo revoke --all.
• Dashboard revocation visibility. The Session Activity widget now records and
  shows session_revoked events with the reason tag and operator, and gives
  escalation_blocked a readable "Escalation" label with distinct pill styling.
• Access-tab readability, accessibility & i18n. The capability-holder table
  lists each capability on its own line with a human-readable label and a paired
  Revoke control — developer-centric slugs move to a hover tooltip and a
  screen-reader span instead of prominent run-on text. Each Revoke button gets a
  capability-specific accessible name, labels are translatable, and the revoke JS
  removes the whole item on success (no stale lingering entry).
• Governance coverage panel fixes (multisite). The coverage panel now names
  the capability it actually scans (manage_network_options on multisite) and no
  longer false-flags super admins as unable to access Sudo settings.

🔗 Two Factor lifecycle bridge

• The optional Two Factor bridge now also gates meaningful classic profile.php
  / user-edit.php provider lifecycle changes — enabling/disabling a provider,
  changing the primary provider, and TOTP enrollment/removal — behind an active
  sudo session. Unrelated profile saves and normalized no-op resubmissions are
  not gated.

🌐 Localization packaging

• WP-CLI-backed Composer commands to regenerate and verify languages/wp-sudo.pot,
  the committed release-grade POT template, and documented workflow.

Compatibility

Requires WordPress 6.4+ and PHP 8.2+. No migration required.

Full Changelog: v4.2.2...v4.5.0

---

This discussion was created from the release WP Sudo 4.5.0 — Session Governance, Admin UX & Security Hardening.