I am pleased to announce the availability of WPO365 version 45.1, a maintenance and security-focused release that further strengthens the platform’s authentication, mail integration, and Media Library Protection capabilities.
Important Update Notice if you enabled Require login for the Media Folder
- It is strongly recommend to update to version 45.1 and then disabling and re-enabling the feature once after the update. This ensures the latest access-control rules are applied to your website.
- If WPO365 cannot write to /wp-content/wpo365, your files in the Media Library stay protected, but every request for an item in the Media Library will load WordPress.
Stronger Security Across Multiple Areas
Version 45.1 introduces several security improvements throughout the WPO365 ecosystem, including additional hardening of the Microsoft mail authorization flow, improved protection against replay attacks when using OpenID Connect Hybrid Flow, and a fix for an XSS vulnerability affecting the premium Mail Log Viewer.
A major focus of this release is the Require login for the Media Folder feature. Significant changes have been implemented to ensure yourMedia Library files are secure:
- Issuing signed access cookies that no longer contain sensitive information
- Ensuring protected files are only served by an active and up-to-date WPO365 premium plugin
- Strengthening validation of requested media paths
- Blocking access to sensitive files such as PHP files and hidden files in the uploads folder
- Adding new administrative warnings to help identify incomplete or outdated configurations
WordPress Multisite Support
Version 45.1 also adds support for “Require login for the Media Folder” on WordPress Multisite networks. When you enabled WPO365 WPMU dedicated mode then each site can maintain its own media protection settings, providing greater flexibility for larger deployments.
Reliability and Compatibility Improvements
This release includes several important fixes and enhancements, including:
- Improved diagnostics for nonce-verification failures.
- A fix for Microsoft Teams silent authentication introduced in version 45.0.
- Better handling of expired WordPress sessions.
- Improved plugin activation and update handling on Multisite networks.
- Support for Microsoft Graph requests in Microsoft 365 Government GCC High environments.
Please update as soon as possible and get in touch, in case you have any questions!