WP Sudo v4.5.0 — Research Snapshot

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

This is a recommended security update: WP Sudo 4.5.0 hardens the admin-escalation guard and session revocation, adds native bulk session revocation with dashboard visibility, and refines the Access-tab capability UI for readability and accessibility — WordPress 6.4+ / PHP 8.2+, no migration.

🔒 Security hardening

• Escalation-guard authority. The opt-in admin-escalation guard now requires the acting user to actually hold the promoting authority — promote_users for administrator grants (checked on the target blog) or existing super-admin for grant_super_admin — in addition to an active sudo session. Sudo is reauthentication, not authorization: a low-privilege account can hold a sudo session, so requiring the session alone could wave through an escalation reached via a broken-access-control route. Blocked grants still fire wp_sudo_escalation_blocked.
• Session-revocation token binding. Users-list session revocation (row action and the new bulk action) now requires the operator's token-bound sudo session, not just a live expiry timestamp. A stolen auth cookie — or a second session without its own sudo — can no longer revoke other users' sessions. Revoking several sessions in a row no longer forces a re-challenge between them.

✨ Session governance & admin UX

• Bulk session revocation. Revoking sessions is now a native "Revoke sudo sessions" entry in the Users-list Bulk actions dropdown (filter to the Sudo Active view, select, apply) — replacing the old toolbar button and its confirmation interstitial, mirroring core's password-reset bulk action. It enforces operator token-bound sudo, consumes one rate-limit slot per batch, skips your own row, and — hardening from external review — runs from a nonce-verified interceptor with a current-site membership guard, so forged user IDs can't revoke or probe other sites' sessions on multisite. Site-wide revoke remains available via wp sudo revoke --all.
• Dashboard revocation visibility. The Session Activity widget now records and shows session_revoked events with the reason tag and operator, and gives escalation_blocked a readable "Escalation" label with distinct pill styling.
• Access-tab readability, accessibility & i18n. The capability-holder table lists each capability on its own line with a human-readable label and a paired Revoke control — developer-centric slugs move to a hover tooltip and a screen-reader span instead of prominent run-on text. Each Revoke button gets a capability-specific accessible name, labels are translatable, and the revoke JS removes the whole item on success (no stale lingering entry).
• Governance coverage panel fixes (multisite). The coverage panel now names the capability it actually scans (manage_network_options on multisite) and no longer false-flags super admins as unable to access Sudo settings.

🔗 Two Factor lifecycle bridge

• The optional Two Factor bridge now also gates meaningful classic profile.php / user-edit.php provider lifecycle changes — enabling/disabling a provider, changing the primary provider, and TOTP enrollment/removal — behind an active sudo session. Unrelated profile saves and normalized no-op resubmissions are not gated.

🌐 Localization packaging

• WP-CLI-backed Composer commands to regenerate and verify languages/wp-sudo.pot, the committed release-grade POT template, and documented workflow.

Compatibility

Requires WordPress 6.4+ and PHP 8.2+. No migration required.

Full Changelog: v4.2.2...v4.5.0