Skip to content
This repository was archived by the owner on Aug 8, 2026. It is now read-only.

WP Sudo v3.1.1 — Research Snapshot

Pre-release
Pre-release

Choose a tag to compare

View all tags
@dknauss dknauss released this 11 May 04:17
· 772 commits to main since this release
v3.1.1
b4f2b0a

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

WP Sudo 3.1.1

Patch hardening release for Playground testing.

Playground

Use this CORS-friendly raw Blueprint URL:

https://playground.wordpress.net/?blueprint-url=https%3A%2F%2Fraw.githubusercontent.com%2Fdknauss%2FSudo%2Fd9246ee4cc88594a5c7f79c2c392a664a0215f0b%2Fblueprint.json

The Blueprint installs the immutable v3.1.1 tag zip.

Security hardening

  • Role and capability metadata writes are now blocked before mutation when sudo is required.
  • Requests with omitted password/secret fields return with a warning instead of replaying partial POST data.
  • Copied and static MU shims recover more reliably across renamed plugin directories.
  • Stream and WP Activity Log bridges now include passed-event audit visibility.

Compatibility and tooling

  • Reflection-based unit tests avoid PHP 8.1-only behavior when running under PHP 8.0.
  • Vulnerable transitive npm development dependencies were updated; npm audit is clean.

Validation

  • Local unit tests, lint, PHPStan, metrics verification, npm audit, and whitespace checks passed.
  • GitHub CI passed on the release commit, including full E2E.
Assets 2
Loading