New WP Ghost by Squirrly updates packs

WP Ghost

= 9.0.10 (13 July 2026) =

Fix - Cloud Activity Log entries are now sent in the background, so a slow logging server can no longer delay backend requests, including the Block Editor and other REST calls
Fix - Force 2FA Setup no longer redirects custom user roles that can't access their profile to a setup screen they are unable to open
Fix - Settings page navigation menu no longer loses its layout on sites where another plugin or theme restricts the allowed HTML tags; the menu now keeps its own classes and attributes regardless of the site's wp_kses filters

WP Ghost

= 9.0.12 (20 July 2026) =

Security - Two-Factor Authentication settings are now bound to the account they belong to, so the 2FA method, authenticator, email codes, backup codes and passkeys can only be managed by the account owner or by an administrator allowed to edit that user
Security - Passkey enrollment is now always self-service, matching the device the passkey is created on
Security - Temporary Login updates and deletions now apply only to temporary accounts, so regular accounts are never affected from this screen
Security - The role assigned to a temporary login is now validated and can never grant more capabilities than the user creating it already has
Security - Magic Login links now require the same permissions as the screen they are offered from

= 9.0.11 (16 July 2026) =

Fix - Editing a custom post type that uses the built-in Categories-Tags taxonomy no longer crashes the Block Editor
Fix - Block Editor no longer crashes when Hide User Enumeration is on; the users REST endpoint is now hidden from anonymous visitors only, so logged-in Editors and Authors can still edit posts and custom post types

Discussion