Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Authorizer · Version history

Authorizer changelog and version history

Latest version
3.16.0
Sep 21, 2026 (1 month ago)
Releases
126
since 2015
In the last year
17
about one every 19 days
Tested up to
WordPress 7.1.4
PHP 8.1 or later

Releases each year

  • 201515 releases
  • 201611 releases
  • 201720 releases
  • 201810 releases
  • 201912 releases
  • 20203 releases
  • 202111 releases
  • 202210 releases
  • 20234 releases
  • 202412 releases
  • 20258 releases
  • 202610 releases

202610 releases

  1. Authorizer 3.16.0Latest

    • Azure OAuth2 configurations without a Tenant ID specified in Authorizer config (or “common” as the Tenant ID) now enforce email verification. Users must perform a one-time email verification by clicking a link in an email sent to them from this WordPress server after a successful Azure sign-in. Bef…
    • Upgrade composer dependencies: firebase/php-jwt (v7.1.0 => v7.2.0); google/apiclient (v2.19.4 => v2.20.0); google/apiclient-services (v0.457.0 => v0.460.0); google/auth (v1.53.0 => v1.55.0); guzzlehttp/guzzle (7.15.5 => 8.2.0); guzzlehttp/promises (2.5.3 => 3.0.2); guzzlehttp/psr7 (2.13.1 => 3.1.0)…
    • Update French translations. Props @julienlusson!

  2. Authorizer 3.15.3

    • Security hardening: prior versions of Authorizer did not restrict Azure OAuth2 tenants when the “Tenant ID” setting was left blank. Starting with this version, an admin notice appears warning users when this setting is blank or “common”. Props Raphael for the coordinated disclosure via wordpress.or…
    • Security hardening: add Azure OAuth2 option “require verified email address”. When enabling this, users logging in will need to perform a one-time email address verification. The WordPress server will email a unique login link to their email address. Reference 1 Reference 2
    • Fix missing admin page title when following a CAS or OAuth2 admin notice link.
    • Upgrade composer dependencies: league/oauth2-github (2.0.0 => 3.1.1); google/apiclient-services (v0.455.0 => v0.457.0); guzzlehttp/guzzle (7.15.3 => 7.15.5); guzzlehttp/promises (2.5.2 => 2.5.3); guzzlehttp/psr7 (2.13.0 => 2.13.1); phpseclib/phpseclib (3.0.56 => 3.0.57); monolog/monolog (3.10.0 =>…

  3. Authorizer 3.15.2

    • Security hardening: prior versions of Authorizer allowed all valid administrator logins to succeed, even if those administrators were not in the Authorizer Approved list. Starting with this version, administrator users will also need to be listed in the Authorizer Approved list in order to successf…
    • Security fix: GitHub OAuth2 logins now only accept verified email addresses. Props Steve for the coordinated disclosure via wordpress.org and patchstack!
    • Configured OAuth2 (generic) providers can now require verified email addresses (a truthy email_verified attribute released from the provider).

  4. Authorizer 3.15.1

    • Security fix: prevent authenticated OAuth2 users from impersonating other users by spoofing OAuth2 user attributes (authenticated privilege escalation). Props Steve for the coordinated disclosure via wordpress.org and patchstack!
    • Upgrade composer dependencies: google/apiclient-services (v0.451.0 => v0.455.0); google/auth (v1.52.0 => v1.53.0); guzzlehttp/guzzle (7.15.2 => 7.15.3); guzzlehttp/promises (2.5.1 => 2.5.2); phpseclib/phpseclib (3.0.55 => 3.0.56).

  5. Authorizer 3.15.0

    • Allow OAuth2 servers to link to WordPress accounts via username instead of email (less secure, but supports more uncommon server configurations). Props mateuswetah for the request!
    • Add option to show WordPress usernames in the Approved Users list.
    • Check reachability of all configured CAS servers, not just the first.
    • Fix Keycloak CAS servers being flagged as unreachable. Props hegocre for the report!
    • Fix database migrations running on new installs.
    • Fix linking to correct tab on overridden multisite setting (for individual external service settings).
    • Fix outdated tab loading in Authorizer Settings (if specified in the querystring).
    • Update composer dependencies: firebase/php-jwt (v7.0.5 => v7.1.0); google/apiclient (v2.19.3 => v2.19.4); google/apiclient-services (v0.440.0 => v0.451.0); google/auth (v1.50.1 => v1.52.0); guzzlehttp/guzzle (7.10.0 => 7.15.1); guzzlehttp/promises (2.3.0 => 2.5.1); guzzlehttp/psr7 (2.9.0 => 2.13.0)…

  6. Authorizer 3.14.4

    • Update French translations. Props @julienlusson!

  7. Authorizer 3.14.3

    • Restore local plugin translations. Props julienlusson for discovering the problem!
    • Fix OIDC logins on Okta (add “Force auth method” option to Authorizer settings and set to client_secret_post). Props @rmarks for the troubleshooting!
    • Show “Logout redirect URI” in OIDC configuration (in case the provider needs that set).
    • Fix various small issues reported by Plugin Check.

  8. Authorizer 3.14.2

    • Force asset reload (for WordPress 7.0 style fixes).

  9. Authorizer 3.14.1

    • Fix login button text alignment in WordPress 7.
    • Admin style fixes for WordPress 7 (settings page and dashboard widget).
    • Tested up to WordPress 7.

  10. Authorizer 3.14.0

    • Fix error on Google and OAuth2 logins from an unsupported domain (when configured to only allow specific domain(s) to log in). Props dbnschools for the bug report!
    • Drop support for PHP 7.2, 7.4, and 8.0. PHP 8.1 or higher is now required (due to dependency requirements).
    • Update composer dependency: phpseclib/phpseclib (3.0.48 => 3.0.52) (security).
    • Update composer dependencies: apereo/phpcas (1.6.1 => 1.6.2); thenetworg/oauth2-azure (2.2.2 => 2.2.5); firebase/php-jwt (v6.4.0 => v7.0.5); google/apiclient (v2.14.0 => v2.19.3); google/apiclient-services (v0.302.0 => v0.440.0); google/auth (v1.26.0 => v1.50.1); guzzlehttp/psr7 (2.8.0 => 2.9.0); m…
    • Avoid using emails as usernames as a fallback when creating a user with a username that already exists. Prefer appending a digit (2-9) after the username, and fall back to a UUID (v4) if username[2-9] all already exist.
    • Allow LDAP logins using email address (as an alternative to username) if the “LDAP attribute containing email address” config option is set.

20258 releases

  1. Authorizer 3.13.4

    • Performance: only autoload plugin options used on every page. The change will take effect the next time the specific option is updated (e.g., the list of Approved Users). Props @raalknz for the suggestion!
    • Update composer dependencies: phpseclib/phpseclib (3.0.47 => 3.0.48).

  2. Authorizer 3.13.3

    • Fix Google logins on hosts with nonstandard PHP session configuration. Props oskarasriauba for the report!
    • Update French translations. Props @julienlusson!

  3. Authorizer 3.13.2

    • Fix php warnings about new OIDC settings if settings have not been saved after updating to version 3.13.x.
    • Allow hiding WordPress logins if only an OAuth2 server is configured.

  4. Authorizer 3.13.1

    • Hotfix for some CAS logins no longer working after the latest update.

  5. Authorizer 3.13.0

    • Released Thu Dec 11, 2025.
    • Add ability to authenticate via OIDC servers. Props lc-sam for the pull request!
    • Fix linking CAS accounts by username on any additional configured CAS servers (previously only worked on the first CAS server).
    • Fix updating first/last names on login for any additional configured CAS/OAuth2/OIDC servers.
    • Update French translations. Props @julienlusson!
    • Update composer dependencies: league/oauth2-client (2.8.1 => 2.9.0).

  6. Authorizer 3.12.1

    • Restore original redirectUri (omit id=1 param) for already-configured OAuth2 servers. This fixes existing clients breaking because the redirectUri no longer matches after updating to Authorizer 3.12.1. Props mdebski for the report!

  7. Authorizer 3.12.0

    • Released Tue Nov 18, 2025.
    • Add setting to send pending user notification emails to individual users (instead of using the setting to send to all users in a role). Props lc-sam for the suggestion!
    • Add ability to define multiple configured OAuth2 endpoints (details).
    • Add ability to define the messages pending and blocked users see after logging in, and the message anonymous users see when visiting public pages on a private site, via filters (authorizer_login_message_pending_users, authorizer_login_message_blocked_users, and authorizer_message_anonymous_users) o…
    • Add Simple History logging on CAS authentication errors.
    • Add logging (Simple History, and error_log) on OAuth2 authentication errors.
    • Update French translations. Props @julienlusson!
    • Update composer dependencies guzzlehttp/guzzle (7.9.2 => 7.10.0), guzzlehttp/promises (2.0.4 => 2.3.0), guzzlehttp/psr7 (2.7.0 => 2.8.0), league/oauth2-client (2.7.0 => 2.8.1), paragonie/constant_time_encoding (v2.7.0 => v2.8.2), phpseclib/phpseclib (3.0.43 => 3.0.47).
    • Move OAuth2/Google/CAS/LDAP settings into separate tabs.
    • Fix redirect_to param discarded by some OAuth2 (generic) servers.
    • Fix typo in bypass usernames.
    • Tested up to WordPress 6.8.

  8. Authorizer 3.11.0

    • Fix for loading translations too early in WordPress 6.7.
    • Add $user param to authorizer_automatically_approve_login hook; can be used to inspect the roles of the logging in user if they already have a WordPress user account.
    • Disable Cloudflare Turnstile verification after a successful authentication provided by the simple-cloudflare-turnstile plugin. We assume we don’t need bot protection from this plugin after coming back from a successful external service authentication.
    • Allow defining approved user welcome email subject and body via filters (authorizer_email_approved_users_subject and authorizer_email_approved_user_body) or wp-config.php constants (define( 'AUTHORIZER_EMAIL_APPROVED_USERS_SUBJECT', '...' ); and define( 'AUTHORIZER_EMAIL_APPROVED_USER_BODY', '...'…
    • Allow defining custom branding option via filter (authorizer_advanced_branding) or constant (define( 'AUTHORIZER_ADVANCED_BRANDING', '...' );). Props oldfieldtc for the request!
    • Allow specifying multiple roles to add and remove in the authorizer_custom_role filter by returning an array with keys 'default_role', 'roles_to_add', and 'roles_to_remove'. Props nick-perry14 for the pull request! (Note: you can also define additional roles in the authorizer_custom_roles_to_add an…
    • Allow specifying a list of “bypass users” who can log in with their WordPress credentials even if Disable WordPress Logins has been checked. Useful if most accounts are authenticated with an external service, but certain accounts, like temporary vendors or new hires, are not able to authenticate wi…
    • Update helper text for OAuth Resource Owner URL. Props howardshand for the suggestion!
    • Update composer dependencies: guzzlehttp/promises (2.0.3 => 2.0.4), monolog/monolog (2.9.3 => 2.10.0), phpseclib/phpseclib (3.0.42 => 3.0.43), symfony/deprecation-contracts (v2.5.3 => v2.5.4).
    • Update translatable strings.
    • Tested up to WordPress 6.7.

202412 releases

  1. Authorizer 3.10.2

    • Fix for redirect error on CAS logins. Props greg-randall for the pull request!

  2. Authorizer 3.10.1

    • Hotfix for CAS logins broken if new settings not saved.

  3. Authorizer 3.10.0

    • Allow multiple configured CAS endpoints (details).
    • Allow fetching username and email from custom attributes in OAuth2 (generic) external service.
    • Add OAuth2 (generic) options for syncing first and last names from external service.
    • Force Google Logins to use FedCM to support upcoming removal of third-party cookies in chromium browsers. Props faeldray for the report!
    • Revert WPML fix from 2017 for displaying categories in the Private Pages list in the Public Access tab of Authorizer settings. Props tlebars for the report!
    • Update French translations. Props @julienlusson!
    • Add $user param to authorizer_custom_role hook; can be used to inspect the roles of the logging in user if they already have a WordPress user account.
    • Add missing authorizer_oauth2_azure_authenticated_email hook (alongside authorizer_oauth2_generic_authenticated_email hook).
    • Update composer dependencies: guzzlehttp/guzzle (7.9.1 => 7.9.2); phpseclib/phpseclib (3.0.39 => 3.0.42).

  4. Authorizer 3.9.1

    • Fix for global $wp_roles unavailable in some multisite contexts leading to a fatal error.
    • Update French translations. Props @julienlusson!

  5. Authorizer 3.9.0

    • Tested up to WordPress 6.6.
    • Fix ldap_connect() deprecation notice in PHP 8.3. Props @svyatoslavnetrunner for the code!
    • Trim whitespace from Google Client ID and Secret. Props @JSLittlefield for the suggestion!
    • Allow defining Google Client ID and OAuth2 Client ID via filters (authorizer_google_client_id and authorizer_oauth2_client_id) or wp-config.php constants (define( 'AUTHORIZER_GOOGLE_CLIENT_ID', '...' ); and define( 'AUTHORIZER_OAUTH2_CLIENT_ID', '...' );) to support integrations with third-party se…
    • Fix Google/LDAP/Oauth2 secrets fields not hiding in Authorizer Settings if overridden by a filter or constant, and the external service is disabled.
    • Fix warning about duplicate DOM IDs in Authorizer Settings.
    • Update composer dependencies: guzzlehttp/guzzle (7.8.1 => 7.9.1); guzzlehttp/promises (2.0.2 => 2.0.3); guzzlehttp/psr7 (2.6.2 => 2.7.0); monolog/monolog (2.9.2 => 2.9.3); paragonie/constant_time_encoding (v2.6.3 => v2.7.0); phpseclib/phpseclib (3.0.37 => 3.0.39); psr/http-factory (1.0.2 => 1.1.0);…

  6. Authorizer 3.8.5

    • Fix database migrations re-running in complex multisite multi-network setups. Props @mpemburn for the research (and endurance) to discover the root cause!

  7. Authorizer 3.8.4

    • Update French translations. Props @julienlusson!
    • Fix TinyMCE settings fields sometimes uneditable. Props dorianborovina for the detailed bug report!
    • Remove package-lock.json (development dependency).

  8. Authorizer 3.8.3

  9. Authorizer 3.8.2

  10. Authorizer 3.8.1

  11. Authorizer 3.7.1

  12. Authorizer 3.7.0

20234 releases

  1. Authorizer 3.6.3.1

  2. Authorizer 3.6.3

  3. Authorizer 3.6.2

  4. Authorizer 3.6.1

202210 releases

  1. Authorizer 3.6.0

  2. Authorizer 3.5.0

  3. Authorizer 3.4.2

  4. Authorizer 3.4.1

  5. Authorizer 3.4.0

  6. Authorizer 3.3.3

  7. Authorizer 3.3.2

  8. Authorizer 3.3.1

  9. Authorizer 3.3.0

  10. Authorizer 3.2.2

202111 releases

  1. Authorizer 3.2.1

  2. Authorizer 3.2.0

  3. Authorizer 3.1.2

  4. Authorizer 3.1.1

  5. Authorizer 3.1.0

  6. Authorizer 3.0.10

  7. Authorizer 3.0.9

  8. Authorizer 3.0.8

  9. Authorizer 3.0.7

  10. Authorizer 3.0.6

  11. Authorizer 3.0.5

20203 releases

  1. Authorizer 2.10.0

  2. Authorizer 2.9.13

  3. Authorizer 2.9.12

201912 releases

  1. Authorizer 2.9.11

  2. Authorizer 2.9.10

  3. Authorizer 2.9.9

  4. Authorizer 2.9.8

  5. Authorizer 2.9.7

  6. Authorizer 2.9.6

  7. Authorizer 2.9.3

  8. Authorizer 2.9.2

  9. Authorizer 2.9.1

  10. Authorizer 2.9.0

  11. Authorizer 2.8.8

  12. Authorizer 2.8.7

201810 releases

  1. Authorizer 2.8.6

  2. Authorizer 2.8.5

  3. Authorizer 2.8.4

  4. Authorizer 2.8.3

  5. Authorizer 2.8.2

  6. Authorizer 2.8.1

  7. Authorizer 2.8.0

  8. Authorizer 2.7.2

  9. Authorizer 2.7.1

  10. Authorizer 2.7.0

201720 releases

  1. Authorizer 2.6.23

  2. Authorizer 2.6.22

  3. Authorizer 2.6.21

  4. Authorizer 2.6.20

  5. Authorizer 2.6.19

  6. Authorizer 2.6.18

  7. Authorizer 2.6.17

  8. Authorizer 2.6.16

  9. Authorizer 2.6.15

  10. Authorizer 2.6.14

  11. Authorizer 2.6.13

  12. Authorizer 2.6.12

  13. Authorizer 2.6.11

  14. Authorizer 2.6.10

  15. Authorizer 2.6.9

  16. Authorizer 2.6.8

  17. Authorizer 2.6.7

  18. Authorizer 2.6.6

  19. Authorizer 2.6.5

  20. Authorizer 2.6.4

201611 releases

  1. Authorizer 2.6.3

  2. Authorizer 2.6.2

  3. Authorizer 2.6.1

  4. Authorizer 2.5.1

  5. Authorizer 2.5.0

  6. Authorizer 2.4.0

  7. Authorizer 2.3.12

  8. Authorizer 2.3.11

  9. Authorizer 2.3.10

  10. Authorizer 2.3.9

  11. Authorizer 2.3.8

201515 releases

  1. Authorizer 2.3.7

  2. Authorizer 2.3.6

  3. Authorizer 2.3.5

  4. Authorizer 2.3.4

  5. Authorizer 2.3.3

  6. Authorizer 2.3.2

  7. Authorizer 2.3.1

  8. Authorizer 2.3.0

  9. Authorizer 2.2.4

  10. Authorizer 2.2.3

  11. Authorizer 2.2.2

  12. Authorizer 2.2.1

  13. Authorizer 2.2

  14. Authorizer 2.1

  15. Authorizer 2.0

Questions about Authorizer’s releases

What is the latest version of Authorizer?

3.16.0, released on Sep 21, 2026 (1 month ago). It’s tested up to WordPress 7.1.4 and needs PHP 8.1 or later.

How often is Authorizer updated?

17 releases in the last year, about one every 19 days. Its first release on WordPress.org dates from April 2015.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Authorizer’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.