Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Shibboleth · Version history

Shibboleth changelog and version history

Latest version
2.5.4
Jun 22, 2026 (4 months ago)
Releases
27
since 2009
In the last year
2
about one every 116 days
Tested up to
WordPress 7.0.8
PHP 5.6 or later

Releases each year

  • 20093 releases
  • 20102 releases
  • 20141 release
  • 20161 release
  • 20172 releases
  • 20185 releases
  • 20204 releases
  • 20211 release
  • 20233 releases
  • 20253 releases
  • 20262 releases

20262 releases

  1. Shibboleth 2.5.4Latest

    • Security: Always require Spoof Key for HTTP auth #117 (thanks @Nxploited)
    • Documentation: Document the _no_account default role option #116 (thanks @beanscg, @dmrzzz)
    • Bumped minimum WordPress version to 4.3 (mostly to appease plugin-check-action, but it does allow cleanup).

  2. Shibboleth 2.5.3

    • Security: Limit redirects to approved hosts #112 (thanks @Belippo, @Jefhumbe)

20253 releases

  1. Shibboleth 2.5.2

    • Compatibility: PHP 8.0 and newer require count() argument to be countable #108 (thanks @Gameink, @frereut)

  2. Shibboleth 2.5.1

    • Compatibility: Fix profile save on WordPress 6.6 #104 (thanks @MadtownLems)

  3. Shibboleth 2.5.0

    • Feature: Add the ability to configure multiple IdPs #101 (thanks @smbader)

20233 releases

  1. Shibboleth 2.4.3

    • Compatibility: Check for Shibboleth username instead of Shib-Session-ID; thanks @spfncer #97
    • CI: Update GitHub Action workflows and code for WordPress coding standard v3 #94
    • Cleanup: Reduced duplication via a logging helper function #95

  2. Shibboleth 2.4.2

    • Documentation: Updated Shibboleth documentation external links #92
    • Accessibility: Improve labels and heading structure on admin pages #92
    • Security: Improve input sanitization and use of nonces #92
    • CI: Switch GitHub Action workflows to check against WordPress coding standard #92

  3. Shibboleth 2.4.1

    • Compatibility: Fix redirect_to issues on WordPress 6; thanks @masteradhoc, @caosborne89, @jakeparis #88
    • Accessibility: Improve color contrast on login page #89
    • Fix user profile to only show account link button to the user themself; thanks @jakeparis #90
    • CI: Add GitHub Action workflows to check against WordPress-Core coding standard #91

20211 release

  1. Shibboleth 2.4

    • Added hooks for hopefully rare cases where user overrides are necessary; thanks @dsXLII #74
    • Better login form support for WordPress 5.3; thanks @jakeparis #76
    • Spelling fixes; thanks @junaidkbr #72
    • General cleanup to better align with the WordPress Coding Standards #80

20204 releases

  1. Shibboleth 2.3

    • Implementing a fallback option for the “Shibboleth Attribute Access Method”. For example, if your web server returns redirected environment variables, but occasionally returns standard environment variables, you would want to enable this option.
    • Removing deprecated create_function() from use.
    • Bumped minimum PHP and WordPress versions to 5.6 and 4.0 respectively.
    • Greatly improved the handling of managed fields and cleaned up options-user.php.

  2. Shibboleth 2.2.2

    • Re-implementing conditional for .htaccess to protect against the Shibboleth Apache module not being installed; thanks to @jrchamp for reporting. This change includes conditionals for mod_shib, mod_shib.c, and mod_shib.cpp. If you run into issues related to this change, please open an issue on GitHu…

  3. Shibboleth 2.2.1

    • Temporarily reverts conditional for .htaccess due to reported issues with cPanel environments.

  4. Shibboleth 2.2

    • Implementing conditional for .htaccess to protect against the Shibboleth Apache module not being installed; thanks to @jrchamp for reporting.
    • Added an option to disable account creation if no mapped roles or default roles exist; props @dandalpiaz.
    • Improve the Shibboleth login link so that when it shows up on a normal request it will correctly still be a login link and will redirect back to the page that showed the login link; props @Alhrath.

20185 releases

  1. Shibboleth 2.1.1

    • Minor code cleanup for disabling authentication and passsword resets; props @jrchamp.
    • Resolved a minor problem where setting the SHIBBOLETH_LOGGING constant on PHP 5.5 or below would not work in the administrative interface; props @jrchamp.
    • Resolved an issue with the default to shibboleth login option in the admin; thanks to @trandrew for reporting.

  2. Shibboleth 2.1

    • Resolved an issue where in multisite users could inadvertently be sent to an unrelated subsite after logging in; thanks to @themantimeforgot for reporting and props to @jrchamp for the fix.
    • Resolved an regression that prevented users from authenticating if shibboleth_default_role is blank and shibboleth_create_accounts is enabled; props @jrchamp.
    • Cleaned up the shibboleth_authenticate_user function; props @jrchamp.
    • Allowed translate.wordpress.org compatibility; thanks to @eric-gagnon for reporting and props to @jrchamp for the fix.
    • Resolved a conflict that caused the lost password and reset password forms to break; props @jrchamp.
    • Resolves an issue where the password reset URL wasn’t being properly displayed on wp-login.php; thanks to @earnjam for reporting.
    • Prevents local password resets if local authentication is disabled; thanks to @earnjam for reporting.
    • Prevents local password changes if local authentication is disabled; thanks to @earnjam for reporting.
    • Standardized the way we check if options are set as constants to prevent duplicate code.
    • For manual account merges, ensure that email comparisons are case insensitive; thanks to @mrbrown8 for reporting.
    • Introduces available logging for various actions the plugin takes.

  3. Shibboleth 2.0.2

    • Resolved an issue that caused manual linking of accounts to fail if user’s didn’t have an existing Shibboleth session.

  4. Shibboleth 2.0.1

    • Resolved a regression that prevented accounts from being created if they matched a group; thanks to @Androclese for reporting.
    • Resolved an issue where assets were not being properly included in the WordPress.org packaged plugin.

  5. Shibboleth 2.0

    • Changed the way we check for Shibboleth attributes. Now, by default, we only check standard environment variables for Shibboleth attributes. For most users, no additional configuration will be necessary. If you are using a specialized server configuration, such as a Shibboleth Service Provider on a…
    • Changed the default behavior to not automatically update user roles.
    • Allow options to be defined via constants. Documentation has been added to the “FAQ” section of the WordPress.org plugins page.
    • Allow automatic and manual merging of local WordPress accounts with Shibboleth accounts. This prevents a collision from occurring if the Shibboleth email attribute matches an email that already exists in the wp_users table. This is configurable by an administrator.
    • Changed the options page to utilize a more modern design centered around tabs.
    • Added signifcant customizations to the login page to bring it more in-line with WordPress.com Single Sign On.
    • Disabled the sending of an email notifying user’s that their email had changed when the Shibboleth plugin updates user attributes to prevent user confusion; props @jrchamp.
    • Removed the shibboleth-mu.php file as it is no longer relevant.

20172 releases

  1. Shibboleth 1.8.1

    • Use sanitize_title rather than sanitize_user to sanitize user_nicename; props @jrchamp.
    • Changed activation and deactivation hooks to use __FILE__; props @jrchamp.
    • Reverted to using $_SERVER in shibboleth_getenv() to handle use cases where getenv() doesn’t return data; thanks to @jmdemuth for reporting.

  2. Shibboleth 1.8

    • The Shibboleth plugin is now being maintained by michaelryanmcneill. Contributions are welcome on GitHub!
    • Adding the ability to disable .htaccess modifications with a wp-config.php constant (SHIBBOLETH_DISALLOW_FILE_MODS).
    • Added shibboleth_getenv() to support various prefixed environment variables from Shibboleth, includingREDIRECT_ and HTTP_; props @cjbnc and @jrchamp.
    • Update various deprecated WordPress functions, including update_usermeta() and get_userdatabylogin(); props @skoranda.
    • Resolved undefined index when calling shibboleth_session_initiator_url(); props @skoranda.
    • Added support for PHP 7.x; props to many people.
    • Added shibboleth_authenticate_user filter; props @boonebgorges.
    • Resolved undefined index on admin-options.php; props @HirotoKagotani, @jrchamp, and @stepmeul.
    • Resolved HTML markup mistake; props @HirotoKagotani.
    • Adds an update success message to let user’s know their settings were saved, using the Settings API.

20161 release

  1. Shibboleth 1.7

    • fixed a security vulnerability reported by WordPress security team
    • load multisite options correctly; thanks to jdelsemme for reporting
    • updated htaccess setting strings; props dericcrago
    • fix reauth loop; props jrchamp
    • set l10n text domain; props jrchamp

20141 release

  1. Shibboleth 1.6

    • tested for compatibility with recent WordPress versions; now requires WordPress 3.3
    • options screen now limited to admins; props billjojo
    • new option to auto-login using Shibboleth; props billjojo
    • remove workaround for MU add_site_option; props billjojo

20102 releases

  1. Shibboleth 1.4

    • tested for compatibility with WordPress 3.0
    • new hooks for developers to override the default user role mapping controls
    • now applies sanitize_name() to the Shibboleth user’s nicename column

  2. Shibboleth 1.3

    • required WordPress version bumped to 2.8
    • much cleaner integration with WordPress authentication system
    • individual user profile fields can be designated as managed by Shibboleth
    • start of support for i18n. If anyone is willing to provide translations, please contact the plugin author

20093 releases

  1. Shibboleth 1.2

    • fix bug where shibboleth users couldn’t update their profile. (props pchapman on bug report)
    • fix bug where local logins were being sent to shibboleth

  2. Shibboleth 1.1

  3. Shibboleth 1.0

Questions about Shibboleth’s releases

What is the latest version of Shibboleth?

2.5.4, released on Jun 22, 2026 (4 months ago). It’s tested up to WordPress 7.0.8 and needs PHP 5.6 or later.

How often is Shibboleth updated?

2 releases in the last year, about one every 116 days. Its first release on WordPress.org dates from March 2009.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Shibboleth’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.