WP Sudo v4.2.0 — Research Snapshot

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

4.2.0 - 2026-06-27

• Two Factor bridge hardening: the optional Two Factor bridge now gates REST
  factor-management operations behind WP Sudo, extending sudo coverage to a
  sensitive 2FA account-control surface.
• Observability (WSAL bridge expansion): the optional WP Activity Log sensor
  bridge maps the additional security/governance audit hooks added in the 4.1.x
  line into WSAL events for escalation blocks, session revocation, recovery-mode
  use, governance-capability changes, missing built-in rules, and regex-rule
  failures.
• Gutenberg REST UX groundwork: cookie-authenticated REST sudo_required
  responses now include a challenge_url so block-editor clients can direct the
  user to reauthenticate without using server-side Request_Stash replay.
  Headless REST policy responses (sudo_disabled / sudo_blocked) are
  unchanged.
• Test hardening: added integration coverage for activation/deactivation
  lifecycle behavior, WP_Session_Tokens::destroy_all() login-session-binding
  invariants, and live admin-escalation guard hooks.
• Planning and reference docs: documented the Gutenberg route inventory, the
  build-free vanilla-JS decision for Phase 2 editor UX work, API-only
  configuration surfaces, and the accepted blog-invariant Connectors matcher
  cache behavior.