2.8.1 — security release

Security release. Update before anything else.

Privilege escalation in the block preview. PHP in a Page Block no longer runs for users who can merely edit the post. The builder's preview endpoint is reachable by anyone with edit_post — an Author, or a Contributor on their own draft — and it executed the section's PHP after deriving the content checksum from the very content it was about to run, so the check was satisfied by definition. On any site that had turned PHP blocks on, that left the site-wide constant standing alone as the only gate. Running PHP in a preview now requires administrator access, and everyone else previews with the tags stripped and a note saying so rather than silently different output.

The update channel verifies certificates again. It was requesting with sslverify off, and the server's reply supplies the package URL WordPress downloads and installs a plugin from, so anything able to answer as the licence server could have installed arbitrary code. Certificates are now verified, the request goes through wp_safe_remote_post(), and any package, url or homepage pointing somewhere other than the licence server's own host is discarded rather than followed. A host with a genuinely broken CA bundle can opt out per-site with GT_PB_LICENSE_INSECURE. The changelog the update screen renders is escaped before display.

The plugin declares what it needs. Requires PHP: 8.1, Requires at least: 6.0, a licence and a text-domain path. It previously declared none, so WordPress offered the update to sites that would fatal on it, and the update payload separately claimed PHP 7.4 while the code has needed 8.1 since 2.7. A site below 8.1 now gets an admin notice naming the versions instead of a white screen. Update URI is set, so the plugin can only ever be updated from its own source.

The licence screen is reachable. It is registered under the Page Blocks menu, but the Plugins row action and both admin notices linked to options-general.php, a screen that does not exist.

Also: the preview endpoint checks the post type, matching the builder; and the GPLv2 text the header declares now ships with the plugin.