Automatic Domain Changer changelog and version history

20262 releases

1. Automatic Domain Changer 3.0.1Latest

   May 8, 2026
   • Hotfix for a regression introduced in 3.0.0.
   • Fix: rows whose serialized payload contains a PHP class instance (for example, the _site_transient_update_plugins transient or any plugin-stored object) were being corrupted into __PHP_Incomplete_Class after a domain change, which caused fatal errors in PHP 8 the next time something tried to mutate…
   • Fix: no-op short-circuit when the old and new domains match (case-insensitively) and no protocol change was requested, so rerunning with the same values cannot itself damage the database.
   • Test: add docker smoke-test cases that seed a stdClass option and an array containing a stdClass, and assert both survive byte-identical.
   • If you ran 3.0.0 with old == new and now see “incomplete object” fatals (for example from wp-migrate-db-pro’s update-checker hook), clear the affected transients with wp transient delete update_plugins --network (and update_themes, update_core) — they regenerate on the next dashboard load.

2. Automatic Domain Changer 3.0.0

   May 8, 2026
   • Major modernization release. The user-facing behavior is unchanged: the same Tools → Change Domain page with the same options and the same backup buttons. Everything else has been rewritten.
   • Security
   • Replaced the raw SQL UPDATE in the domain-change routine with prepared $wpdb->update() calls to eliminate a SQL injection risk on the primary-key value.
   • unserialize() is now called with allowed_classes => false so a malicious serialized payload in a row cannot trigger PHP object injection while the plugin scans the database.
   • Option writes (auto_domain_change-https, auto_domain_change-www) are now gated behind both nonce verification and an update_core capability check. Previously, any authenticated POST to the admin page could flip them.
   • Dismissing the domain-change admin notice now requires a nonce and the update_core capability (previously a plain ?dismiss-domain-change=1 GET, vulnerable to CSRF).
   • All $_POST, $_GET, and $_SERVER values are sanitized; force-protocol is validated against an allow-list; submitted domains are validated against a host-name pattern before being used.
   • Explicit capability checks at the top of the admin page and both backup routines (defense in depth).
   • Drops the PHP-4 &$this reference style and the manual pluggable.php require.
   • Compatibility
   • Requires PHP: 7.4, Requires at least: 5.0. Older PHP silently ignored unserialize()‘s allowed_classes option, defeating the object-injection guard, so older versions are now refused with a clear admin notice.
   • Tested up to WordPress 6.9.4.
   • Architecture
   • Restructured into a PSR-4 layout under NuageLab\AutoDomainChanger\ with a tiny hand-rolled autoloader (no Composer required at runtime).
   • Extracted the admin form to a template, the styles to assets/css/admin.css, and the click handler to vanilla assets/js/admin.js (no jQuery).
   • The serialize/JSON walker (Domain\Replacer) is now a self-contained class that can be invoked independently of the admin UI.