Admin and Site Enhancements (ASE) Pro 8.4.2

8.4.2 (2026.03.02) - ASE Free and Pro

* **[FIXED in Free] Content Management >> Content Duplication**: fixed missing 'Duplicate' link in post actions row in the post listing screen since v8.4.1 introduced a security fix for this module. Props to st@n, @ilanaw, @michoscopic, @lineadiconfine, @dannyfoo and @webkatdesign for [reporting](https://wordpress.org/support/topic/duplicate-post-page-7-4-1-bug/) the bug.

* **[IMPROVED in Pro] Security >> Two-Factor Authentication (2FA)**: Grace period notice that urges users with the relevant roles to set up 2FA is now excluded from being hidden by the Hide Admin Notices module. This ensures that those users see it when they log in.

* **[FIXED in Pro] Plugin Activation**: fixed a fatal error that occurs in a certain scenario during plugin activation. Props to Alistair W. for reporting the issue and facilitating the troubleshooting process.

* **[FIXED in Pro] Content Management >> Media Categories**: fixed a PHP warning that occurs in a certain scenario.

* **[FIXED in Pro] Content Management >> Custom Content Types >> Custom Field Groups**: fixed a fatal error that occurs when trying to edit a Bricks template for a taxonomy archive when a custom field group is attached to that taxonomy and no specific taxonomy term has been selected to preview the archive in the builder. Props to David W. for reporting the issue in detail (with error stack trace) and facilitating the troubleshooting process.

* **[FIXED in Pro] Content Management >> Content Order**: Fixed a bug that affects non-hierarchical post types causing duplicating menu_order in pairs of posts, posts occasionally / randomly being nested as child post during drag and dropping, and drag-and-dropping not working reliably when dragging a bit too far to the right hand side in the 'Order' page. Props to Christian S. for reporting the issue in detail, with screen recordings, and facilitating the troubleshooting process further.

* **[FIXED in Pro] Utilities >> File Manager**: fixed a fatal error that occurs in a scenario where mime_content_type() is not available in PHP because magic module is disabled. Props to Bill J. for reporting the issue in detail.

* **[FIXED in Pro] Utilities >> Local User Avatar**: fixed an issue with `get_avatar_url()` override always returning URL for the `thumbnail` size of the avatar and ignoring size parameter. This for example, can break Bricks builder's `{author_avatar:512}` dynamic tag. Props to Martin Ž. for reporting the issue in detail.

8.4.1 (2026.02.23) - ASE Free and Pro​

• [SECURITY FIX in Free] Content Management >> Content Duplication: fixed "Broken Access Control" vulnerability with CVSS severity "Medium (5.4)"" that could cause "Information Disclosure" as responsiblly disclosed by security researcher Jakub Herman via Pathstack. In practical terms, this for example, can allow a logged-in user with contributor role to duplicate (and then view) password-protected content created by an administrator via the admin bar duplication link of the password-protected post in the frontend.
• [IMPROVED and FIXED in Pro] Utilities >> Form Builder:
  • Added bulk export / import for forms via an "Export / Import Forms" button in the forms listing page, which links to the Form Builder section in ASE settings "Export | Import" section. You can choose to export all forms, or manually select which forms to export.
  • Added bulk export / import for style templates via an "Export / Import Style Templates" button in the forms listing page, which links to the Form Builder section in ASE settings "Export | Import" section. You can choose to export all style templates, or manually select which style templates to export.
  • Added bulk export for form entries via an "Export Entries" button in the forms listing page, which links to the Form Builder section in ASE settings "Export | Import" section. You can choose to export entries from a particular form, and customize what entry data will be exported, set the output format (CSV, Excel or JSON) and set a data range to filter by. Props to Uli L., Richard L. and Dave P. for prompting this improvement.
  • Security hardening for the upload field by removing trust in client-sent constraints and enforcing server-side file policy.
  • Stop recording IP address during form submissions.
  • Fixed custom CSS classes not being output for "Display" field types, e.g. HTML field. Props to Yan for reporting the issue.
• [FIXED in Free and Pro] Content Management >> Content Order: fixed layout issue in the content order page caused by CSS being overridden by the MetForm Pro plugin's CSS. Props to @once-master for prompting this fix.
• [FIXED in Pro] Security >> CAPTCHA Protectino >> ALTCHA: fixed a JS error in Firefox browser related to @Wordpress/interactivity when an ALTCHA field is included in a form via the Form Builder module. Props to Yan for reporting the issue.
• [TRANSLATION in Free and Pro] ASE is now being translated into 38 languages:
  • Added new/improved translationfor:
    • ASE Free: Updated Serbian, Turkish, Spanish (Spain), Portuguese (Brazil), Polish, Persian, Norwegian, Dutch, Danish, Azerbaijani, Albanian
    • ASE Pro: Updated Norwegian. Completed Serbian (special props to Igor E.).

v8.4.0 (2026.02.16) - ASE Free and Pro
* **[ADDED in Pro] Security >> Two-Factor Authentication**: Add an extra verification step during login for some or all user roles with grace period settings. Supported methods are authenticator app (TOTP), recovery codes and email. Compatible with the Change Login URL module. Props to Sebastian, Laurent F., Jonathan, Carlos d.A. Silvan L., Luethi, Ramyt I., Ammar, Marcel S., Drijen S., Stefan B., Timothy L. and Cory V. for prompting this addition.

* **[FIXED in Free and Pro] Disable Components >> Disable Gutenberg**: fixed a PHP fatal error that occurs in a certain scenario. Props to [@d79](https://wordpress.org/support/users/d79/) for [reporting](https://wordpress.org/support/topic/bug-disable-gutenberg-%e2%86%92-fatal-error/) this in detail with the error entry log.

* **[TRANSLATION in Free and Pro]** ASE is now being translated into [38 languages](https://translate.wpase.com/):
* **Added new/improved translation** for:
* ASE Free: updated Danish, Spanish (Chile), Russian, Portuguese (Brazil), Polish, Persian, German, Dutch (Netherlands), Dutch (Belgium)
* ASE Pro: updated Danish, Portuguese (Brazil)

### 8.3.2 (2025.02.09) - ASE Free and Pro

* **[IMPROVED in Free and Pro] Security >> Limit Login Attempts**:
* ASE Free: when an IP address is locked out because it's exceeded the allowed failed login attempts amount, there will be a "Release Lock" button shown in a new "Actions" column in the "Failed login attempts" list within the Limit Login Attempts module. This will easily remove the IP address from lockout and allow the user on that IP address to attempt another set of login attempts. Props to [Michael K.](https://wordpress.org/support/users/michoscopic/) for [prompting](https://wordpress.org/support/topic/any-way-to-unblock-user-after-limit-login-attempts/) this improvement.
* ASE Pro: in addition to the "Release Lock" button, there will also be a "Whitelist" button that will automatically copy the IP address to the "Never block the following IP addresses" section.

* **[IMPROVED in Free and Pro] Content Management >> SVG Upload**: when an SVG has the width and height attributes at 100%, the width and height is now going to be detected from the viewBox attribute and properly saved in the attachment metadata (width, height, dimensions).

* **[IMPROVED and FIXED in Pro] Custom Code >> Code Snippets Manager**:
* To date, each revision is saved as a new file in the snippets folder. Going forward snippet creation and update will trigger a process to ensure only one file exists for each snippet and snippet deletion will remove snippet revision files, while ensuring the revisions feature will continue to work. Props to Claudio P. for prompting this improvement.
* Fixed an issue in a certain scenario where snippets filtering and search are not working properly. Props to Oliver S. for reporting this.

* **[IMPROVED in Pro] Content Management >> Custom Content Types >> Custom Field Groups**: added `m.d.Y` format, e.g. `12.31.2025` for the date field's output format. This format is commonly used in Germany. Props to Oliver Z. for prompting this improvement.

* **[IMPROVED in Pro] Utilities >> Form Builder**: the date picker now shows the year as a dropdown, making it easier to select a particular year. Props to Richard L. for prompting this improvement. Also improved the UI to remove extra white space on the right hand side of the day numerals.

* **[IMPROVED in Pro] Admin Interface >> Hide Admin Bar**: add a new option to "always show the admin bar for administrators on the backend", which is useful for scenarios when an administrator user is also assigned other roles for which the admin bar is being hidden on the backend. Props to André C. for prompting this improvement via a comprehensive feedback (setup, observed behaviour, expected behaviour) and useful screenshots.

* **[IMPROVED in Pro] Utilities >> Form Builder**:
* Improve mechanism to prevent file of the same name being overwritten via the file upload field. Props to Ingo R. for prompting this improvement.
* Add a way to choose webhook payload structure so it is more compatible with various requirements. Props to Ingo R. for prompting this imprvement.

* **[FIXED in Pro] Admin Interface >> Admin Logo**: fixed an issue when certain types of SVGs are used for admin menu logo, there are extra-wide spacing at the top and bottom of the logo image. Props to Henry R. for reporting this issue.

* **[TRANSLATION in Free and Pro]** ASE is now being translated into [38 languages](https://translate.wpase.com/):
* **Added new/improved translation** for:
* ASE Free - Update Ukrainian, Spanish (Spain), Portuguese (Brazil), Polish, Norwegian, French, Dutch, Arabic.
* ASE Pro - Update Norwegian, Portuguese (Brazil), Polish.

8.3.1 (2025.02.02) - ASE Free and Pro

* **[IMPROVED in Free and Pro] Admin Interface >> Hide Admin Notices**: notice/ad from BdThemes Element Pack Pro plugin is now properly moved to the notices panel. Props to Alexander P. for reporting the issue.

* **[IMPROVED in Pro] Content Management >> External Permalinks**: add an option to enable the module "only on", "except on" or "on all" post types. Props to Martin S. for prompting this improvement.

* **[IMPROVED in Pro] Content Management >> Media Categories**: add an option to disable the media categories features for some or all non-administrator user roles with access to the media library, i.e. user roles with `upload_files` capability.

* **[IMPROVED in Pro] Admin Interface >> Admin Logo**: add an option to replace the home icon in the admin bar with the site logo set in "Settings >> General". Props to Martin S. for prompting this improvement.

* **[IMPROVED in Pro] Content Management >> Custom Content Types >> Custom Field Gropus**:
- add a top sticky bar with title and publish / update button when the custom field group creation / edit screen is scrolled down.
- in the custom field groups listing page, for the Placement colum, labels are now added before the raw values, e.g. 'post' becomes "Post (post)".

* **[IMPROVED in Pro] Optimizations >> Image Upload Control**: when "Only apply resize and conversion to media library and block editor uploads" is checked/enabled, only uploads done directly in the media library or within the context of creating or editing pages and posts will go through conversion (to JPG or WebP). This provides better isolation, so that plugins that incorporates the block editor in creating something, e.g. MailPoet creating newsletter in wp-admin (not frontend form), will no longer have image uploads automatically converting to JPG / WebP, where conversion to WebP may result in blank image in some email clients. Props to Lee B. for prompting this improvement.

* **[FIXED and IMPROVED in Pro] Admin Interface >> Clean Up Admin Bar**:
* fixed an issue where admin bar menu item from the Paymattic plugin is not being properly detected and listed for removal. Props to Maik E. for reporting the issue
* add a button to clear and rescan the list of extra admin bar elements that may have piled up over time and no longer reflects the current state of the admin bar.

* **[FIXED in Pro] Custom Code >> Code Snippets Manager**: fix category filter not working in the snippets listing page. Props to Mirko S. for reporting the issue.

* **[TRANSLATION in Free and Pro]** ASE is now being translated into [38 languages](https://translate.wpase.com/):
* **Added new/improved translation** for:
* ASE Free - Updated Spanish (Spain), Portuguese (Brazil), Polish, French, Dutch,.
* ASE Pro - Updated Polish.

8.3.0 (2025.01.26) - ASE Free and Pro​

• [ADDED in Free and Pro] Content Management >> Media Files Visibility Control: in ASE Free, this module will limit media library in a way that only administrators can see all media files. Non-administrator users will only see media files they uploaded themselves in the media library and in the modal window to add/insert media. ASE Pro adds an option to specify which non-administrator user roles will be limited to only seeing media files they uploaded themselves.
• [IMPROVED in Pro] Content Management >> Custom Content Types >> Custom Field Groups:
  • In the Placement tab, post types now shows the label as well. e.g. 'post' now becomes 'Posts (post)'.
  • In the Placement tab, user roles now shows the label as well. e.g. 'administrator' now becomes 'Administrator (administrator)'.
  • Fixed PHP warnings related to custom field group creation / update process.
• [IMPROVED in Pro] Utilities >> File Manager:
  • Add the option to set FM_READ_ONLY constant to true in wp-config.php if you want to activate read-only mode, i.e. only Open and Download actions are available.
  • Add a note in the module to quickly explain about enabling the read-only mode by setting FM_READ_ONLY, DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT to true in wp-config.php.
• [IMPROVED in Pro] Custom Code >> Code Snippets Manager:
  • add an "Export / Import Snippets" button in the snippets listing page and an "Export / Import Snippets" submenu item inside the "Code Snippets" admim menu. Both link to the snippets export / import section in the main ASE settings page, at the bottom. Props to Henry R. for prompting this improvement.
  • for CSS snippets, there's a new option to load the snippet within the block editor. It's located under the "Frontend >> Type of page" conditional. Props to Emmanuel A. for prompting this improvement.
  • add a note in the module about manually activating safe mode to regain access to wp-admin when a PHP snippet triggers a pervasive fatal error.
• [IMPROVED in Pro] Admin Interface >> Admin Columns Manager:
  • When all active columns are set to auto width, horizontal scrolling will automatically be disabled in the list table of posts. This ensures that the righ-border-line for the first column will not be displayed in such a scenario.
  • Add an option to make the column header row sticky (on top) on scroll.
  • Add an option to set the number of (first) columns to freeze when horizontal scrolling is enabled.
• [TRANSLATION in Free and Pro] ASE is now being translated into 38 languages:
  • Added new/improved translationfor:
    • ASE Free - Updated Vietnamese, Russian, Portuguese (Brazil), Polish, Norwegian, Dutch (Belgian), Dutch, Bengali (Bangladesh)
    • ASE Pro - Indonesian, Vietnamese, Polish, Norwegian, Portuguese (Brazil).

### 8.0.4 (2025.10.27) - ASE Free and Pro

* **[IMPROVED in Free and Pro] Utilities >> Multiple User Roles**: the 'Administrator' role checkbox will now be disabled to prevent accidentally removing this role and cause the user to lose the admin role without an easy way to restore it. Props to [Edward B.](https://wordpress.org/support/users/edviser/) for [prompting](https://wordpress.org/support/topic/how-to-regain-admin-access-when-misusing-multiple-userroles-feature/) this improvement.

* **[FIXED in Free and Pro] Disable Components >> Disable REST API**:
* ASE Free: fixed an issue whre The Events Calendar ajax-based navigation of the frontend calendar broke, because it's REST API route is disabled. The route has been automatically excluded from being disabled, i.e. automatically whitelisted. Props to Michael D. for reporting the issue.
* ASE Pro: fixed an issue with how excluded routes are not being properly handled and excluded due to a flawed logic in the code. Props to Eric C. for reporting the issue and suggesting a code fix for it, and props to Michael D. for reporting a related issue with excluding The Events Calendar routes not properly working.

* **[IMPROVED in Pro] Utilities >> Form Builder**: added feature to export and import forms. This is done via the 'Settinsg' tab. Once exported, on the target site, create a blank form and go to the 'Settings' tab to import the form. Props to Marcellus J. Hoang H., netcit, Bo M. and John E. for suggesting this improvement.

* **[TRANSLATION in Free and Pro]** ASE is now being translated into [35 languages](https://translate.wpase.com/):
* **Added new/improved translation** for:
* ASE Free: Updated Slovak, Portuguese (Brazil), Polish, Japanese, Dutch, Danish, Chinese (Taiwan), Arabic.
* ASE Pro: Updated Portuguese (Brazil), Hungarian.

### 7.9.3 (2025.07.28) - ASE Free and Pro

* **[IMPROVED in Free and Pro] Disable Components >> Disable Gutenberg**: improve code to remove frontend Gutenbeg assets to account for edge cases. Props to Mike D. for prompting the improvement.

* **[IMPROVED in Pro] Content Management >> Custom Content Types >> Custom Field Groups**: added shortcode sub-type for text field and implement shortcode output for this sub-type in Oxygen, Breakdance and Elementor. Props to Radoslaw B. for prompting this improvement.

* **[FIXED in Pro] Utilities >> Form Builder**: fixed a PHP warning error related to the display of name field in the entries list page. Props to Radoslaw B. for reporting the issue in detail, including the error log entry and a screenshot.

* **[TRANSLATION in Free and Pro]** ASE is now being translated into [33 languages](https://translate.wpase.com/):
* **Added new/improved translation** for:
* ASE Free: updated Slovak, Portuguese (Brazil), Polish, Japanese,
* ASE Pro: updated German and Japanese.

### 7.9.2 (2025.07.21) - ASE Free and Pro

* **[IMPROVED in Free and Pro] Log In/Out & Register >> Change Login URL**: when in Settings >> General, "Membership: Anyone can register" is checked, opening /wp-signup.php will no longer redirect to the registration form. The custom login slug is required in the URL, i.e. /wp-signup.php?custom_login_slug, to be able to access the registration form.

* **[IMPROVED in Pro] Utilities >> Form Builder**: Improved accessibility of the file upload field. Make sure all input elements in this field have corresponding labels. Props to Claudio P. for prompting this improvement.

* **[FIXED in Pro] Admin Interface >> Admin Menu Organizer**: fixed an issue where the 'Hide' options were not being properly shown in full or were toggleable correctly when wp-admin is set to display in non-English language and the Independent Analytics plugin is active. Props to François A. for reporting the issue in detail and facilitating the troubleshooting process.

* **[FIXED in Pro] Custom Code >> Code Snippets Manager**: fixed an issue where on importing PHP snippets, backslashes were unnecessarily removed, e.g. from regex patterns, resulting in broken, non-working snippets. Props to Oliver Z. for reporting the issue in detail and facilitating the troubleshooting process.

* **[TRANSLATION in Free and Pro]** ASE is now being translated into [33 languages](https://translate.wpase.com/):
* **Added new/improved translation** for:
* ASE Free: updated Portuguese (Brazil), Chinese (China), Catalan.
* ASE Pro: Completed Spanish (100%). Special props to Lluis H. for a great effort in completing the translation.