Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

WPO365 · Version history

WPO365 changelog and version history

Latest version
45.2
Nov 4, 2026 (5 days ago)
Releases
101
since 2022
In the last year
31
about one every 12 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 202219 releases
  • 202322 releases
  • 202419 releases
  • 202514 releases
  • 202627 releases

202627 releases

  1. WPO365 45.2Latest

    • Security: Fixed the SAML 2.0 replay protection. WPO365 now records each SAML assertion in the database when it’s first used, and refuses any later attempt to sign in with the same SAML response. [LOGIN]
    • Security: Hardened the nonce check for sign-ins with OpenID Connect: when two requests try to use the same nonce at the same moment, only the first is accepted. [LOGIN]
    • Security: Updated phpseclib to version 3.0.58 (was 3.0.52). [LOGIN, MAILER]
    • Fix: On websites with a persistent object cache (e.g. Redis or Memcached), the WPO365 configuration no longer shows premium features as locked when the cache held an outdated list of active premium plugins. Opening the configuration, the “Verify license and check for plugin updates” button on the L…
    • Fix: Microsoft 365 apps added with the [pintra] shortcode (e.g. the Employee Directory) now load on websites where WordPress and the wp-content folder are in separate folders, as some managed hosts set it up. Before, WPO365 took them for a deprecated version: the app did not load, and a health mess…

  2. WPO365 45.1

    • Security: Hardened how WPO365 processes the mail authorization response. [LOGIN, GRAPH MAILER]
    • Security: While “Skip NONCE verification” is turned on for a website that uses the OpenID Connect Hybrid Flow, WPO365 now shows a warning that the website must be considered vulnerable to replay attacks. [LOGIN]
    • Security: Fixed a cross-site scripting (XSS) vulnerability affecting the premium mail Log. [MAIL]
    • Security: Hardened “Require login for the Media Folder”: The access cookie is now signed with a per-site secret, it no longer contains sensitive information, and is only issued while the feature is switched on. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
    • Security: If you use “Require login for the Media Folder” on an Apache website that relies on .htaccess for access control, please disable and then re-enable the option on the plugin’s “Roles + Access” configuration page after updating, to apply an important update to the .htaccess access rules. [E…
    • Security: Requests for Media Library items protected by “Require login for the Media Folder” are now only handled by an active WPO365 premium plugin, never by an inactive (possibly outdated) one that is merely installed. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC,…
    • Security: Hardened how WPO365 checks the requested path of a Media Library item while “Require login for the Media Folder” is switched on. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
    • Security: While “Require login for the Media Folder” is switched on, WPO365 now shows a warning in the WordPress admin if the premium plugin that provides it has not yet been updated, so that the security improvements that are available with version 45.1 are fully applied. [ESSENTIALS, ROLES + ACCE…
    • Security: “Require login for the Media Folder” now blocks requests for certain files in the uploads folder, such as PHP files and hidden files (e.g. .htaccess), so that their contents can no longer be downloaded. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANE…
    • Feature: “Require login for the Media Folder” is now available on WordPress multisite networks, both with subdirectories and with subdomains. Each site’s own settings (and in dedicated mode, its own on/off switch) apply to its files. Existing networks that still have the option switched on must dis…
    • Change: While “Require login for the Media Folder” is switched on but no active WPO365 premium plugin provides it, Media Library items are no longer protected, and WPO365 shows a warning in the WordPress admin. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
    • Improvement: WPO365 now shows a warning in the WordPress admin when “Require login for the Media Folder” is switched on but its rules are not applied, e.g. after importing a configuration. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
    • Improvement: When a sign-in fails with “Your login might be tampered with”, WPO365 now logs why the sign-in could not be verified (e.g. the sign-in link had been used before, or was not created by this website), to help find caching and server configuration issues. [LOGIN]
    • Fix: When a WordPress session expires, the “Session expired” prompt now always appears, instead of the website’s home page opening in the popup window. [LOGIN]
    • Fix: Single sign-on inside Microsoft Teams (silent authentication) failed since version 45.0. It now bypasses the nonce check in a safe way and also works with Redirect URI’s “strict mode”. [LOGIN]
    • Fix: Deactivating WPO365 | LOGIN now switches “Require login for the Media Folder” off and removes its .htaccess rules, instead of leaving the rules behind and causing a critical error for requests for Media Library items. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYN…
    • Fix: An updated “Secure Download Mode” now takes effect for Media Library items the next time a user signs in or opens a page while signed in, instead of only after switching “Require login for the Media Folder” off and on again. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGI…
    • Fix: A Microsoft 365 app no longer shows “A deprecated version of a Microsoft 365 (Embed) App has been detected” when the premium plugin is up to date but WPO365’s cached list of active plugins was outdated. If the plugin is really outdated, only administrators see the details; other visitors see a…
    • Fix: On WordPress multisite networks, activating, deactivating or updating a WPO365 premium plugin network-wide now refreshes every site’s list of active premium plugins, so that the premium options appear in each site’s configuration. [ESSENTIALS, ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS…
    • Fix: For a “Government GCC (High)” tenant, WPO365 now sends its requests to Microsoft Graph (e.g. to retrieve a user’s attributes, group memberships or profile picture) to graph.microsoft.us instead of graph.microsoft.com, where they failed with “SecurityTokenInvalidCloudInstanceException”. [LOGIN]

  3. WPO365 45.0

    • Security: Fixed a cross-site scripting (XSS) vulnerability. [LOGIN]
    • Security (breaking): Discontinued the option that let apps request any Microsoft Graph endpoint, because it could be misused to reach services it was never meant to; each endpoint must now be explicitly allow-listed. [LOGIN]
    • Security: Hardened how allow-listed Microsoft Graph endpoints are matched, so a look-alike web address can no longer slip past the check. [LOGIN]
    • Security: Apps can now only request the application-level Microsoft Graph permissions that an administrator has explicitly allowed. [LOGIN]
    • Security: Whether a request to Microsoft Graph uses application-level or the signed-in user’s permissions is now decided by the app’s saved configuration rather than by the request itself. [LOGIN]
    • Security (breaking): Uploading a file to SharePoint now always uses the signed-in user’s own permissions, addressing a security concern with application-level uploads. [LOGIN]
    • Security: Detailed Microsoft 365 error responses are now shown only to administrators and no longer to other visitors. [LOGIN]
    • Security: Added a safeguard so that an access token with application-level permissions can never be handed to the browser. [LOGIN]
    • Security: Prevented apps from influencing an outgoing request in a way that could send the website’s credentials to an unintended destination. [LOGIN]
    • Security: Hardened the “Licenses” page. License requests to wpo365.com now also verify the server’s SSL certificate, unless “Skip SSL host verification” is checked on the plugin’s “Miscellaneous” configuration page. [LOGIN]
    • Security: Fixed an authentication bypass affecting sites that enabled the deprecated option “Use Firebase\JWT instead of phpseclib”. The option has been removed. [LOGIN]
    • Security: Fixed an issue that allowed users from tenants that were not allow-listed to sign in to multi-tenant websites. ID tokens are now always checked for the right issuer and audience, and the option “Skip ID token verification” has been removed. [LOGIN]
    • Improvement: When “Require login for the Media Folder” is enabled, visitors from one of the “IP addresses freed from authentication” can now also open files in the Media Library without signing in. Developers can use the new filter “wpo365/media/skip_authentication” to grant the same access based o…
    • Improvement: The authentication scenarios “Internet (auth. only)” and “Intranet (auth. only)” and the option “Require login for the Media Folder” are now also available with WPO365 | ROLES + ACCESS (requires version 45.0 of that plugin). [ROLES + ACCESS]
    • Improvement: Power BI reports that use the optimized mobile layout now switch between the mobile and desktop layout when the browser window is resized. [APPS, INTEGRATE (INTRANET)]
    • Change (breaking): “Require login for the Media Folder” is no longer available on WordPress multisite networks due to reliability concerns. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS, ROLES + ACCESS]
    • Fix: License keys are now always saved in the database. Any license keys in your wp-config.php overrides (WPO_OVERRIDES) are copied to the database automatically after updating to version 45.0 and then ignored. [ANY PREMIUM]
    • Fix: On websites that use wp-config.php overrides (WPO_OVERRIDES), one-time upgrade tasks no longer run again on every page load. [ANY PREMIUM]
    • Fix: After signing in, files from the Media Folder were not always delivered with the configured “Secure Download Mode” (e.g. for LiteSpeed servers) for up to 24 hours. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
    • Fix: “Require login for the Media Folder” now also works when WPO365 | CUSTOMERS is the only premium plugin installed. Until now, files from the Media Folder then failed to load. [CUSTOMERS]
    • Fix: Adding an app in the wizard right after adding one “For customers” no longer creates it with “Allow anonymous users to interact with this app” checked. [LOGIN]
    • Fix: The SAML 2.0 Service Provider metadata generated by WPO365 now has a valid logout URL (also repaired automatically on sites that saved the malformed default of earlier versions), no longer claims that sign-in requests are signed, and includes the NameID format. [LOGIN]

  4. WPO365 44.1

    • Fix: Microsoft’s infrastructure is currently incompatible with OpenSSL 3.5 and higher’s new default settings (as shipped with e.g. Debian 13), which could make sign-in or Microsoft Graph requests unexpectedly fail with a “Not Found” error on affected web hosts (e.g. IONOS / Fasthosts) – the plugin…

  5. WPO365 44.0

    • Support for WordPress 7.1. [ALL]
    • Feature: Use Copilot Rewrite – a block-editor sidebar tool – to rewrite selected content blocks (paragraphs, headings, lists, quotes, code, and more) with AI assistance, including support for personal and organization-wide rewrite instructions. [ESSENTIALS, PROFESSIONAL, INTEGRATE (LOGIN+, SYNC, IN…
    • Feature: Copilot Chat is a new app that lets visitors have an AI-powered conversation grounded in your organization’s Microsoft 365 / SharePoint content, embeddable anywhere on your WordPress site – with conversation export, retry-on-failure, source attributions, and custom styling support. [APPS,…
    • Feature: Enable a fully customizable WordPress Login Page at https://{your website}/wpo/Login and optionally hide the classic WordPress page “/wp-login.php”, with an option to hide the username / password form, custom branding, layout (single or split-column), colors, logo, custom title / descripti…
    • Feature: Added a matching custom “Logged Out” page (‘/wpo/loggedout’) that can be used as the default landing page after sign-out or an SSO sign-in error, without needing a separately configured error page. [ESSENTIALS, PROFESSIONAL, INTEGRATE (LOGIN+, SYNC, INTRANET)]
    • Improvement: A fully redesigned, more compact calendar list layout with a day-badge, and a combined start/end time column. Events that span multiple days or last all day are now displayed more clearly, showing correct start / end dates and an “All day event” label instead of confusing time ranges.…
    • Improvement: The plugin will now – on a daily base – automatically refresh the Microsoft Graph mail connection’s access and refresh token, so outgoing mail no longer risks failing due to a long-expired token after periods of low activity. [LOGIN, MAILER] Consult the update tutorial
    • Improvement: Added automatic detection and suppression of duplicate outgoing emails sent within a short time window. [LOGIN, MAILER] Read more
    • Improvement: The existing “obfuscate Entra ID options” switch – that will delete sensitive Entra ID settings from the database once they’re defined in ‘wp-config.php’ when toggled on – is now capable of automatically restoring those settings if switched off again. [ANY PREMIUM] Read more
    • Improvement: Added an optimized mobile layout option (portrait or landscape) for embedded Power BI reports on narrow screens. [APPS, INTEGRATE (INTRANET)]
    • Improvement: The “Sign in with Microsoft” button – when multiple identity providers are configured – now highlights the identity-provider dropdown in red if you try to sign in without picking one, instead of just leaving the button disabled with no explanation. [LOGIN]
    • Improvement: The “block direct Media Folder access” feature now (again) support a “Secure Download Mode” for Litespeed servers (requires additional server-configuration – consult online documentation). [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMER (LOGIN+, SYNC, INTRANET)]
    • Improvement: Added “Default LD assignment scope” as an additional option to configure default LearnDash course and group assignments, so you can control whether those assignments should be applied to new users only, instead of always being applied to all users. [ROLES + ACCESS, PROFESSIONAL, INTEGR…
    • Improvement: The plugin’s built-in “Send WordPress emails using Microsoft Graph” feature nows honor a “Retry-After” header – when Microsoft Graph throttles a request – with a short automatic retry, instead of failing immediately. [LOGIN, MAILER]
    • Improvement: If you have configured multiple Identity Providers, you can now configure the “Allow users from other tenants” setting individually for each identity provider in wp-config.php. [LOGIN]
    • Fix: Tested for compatibility with multilingual plugins that add language-specific URL paths, such as “/en” and “/nl”. [LOGIN]
    • Fix: The start / end date and time of Calendar app events are now correctly translated to the user’s timezone. [LOGIN, APPS, INTEGRATE (INTRANET)]
    • Fix: The “Access Denied” message shown to users blocked for not belonging to a required group has been corrected to a more accurate, specific message. [ROLES + ACCESS, PROFESSIONAL, INTEGRATE, CUSTOMERS (SYNC, INTRANET)]
    • Fix: The wizard no longer shows a misleading “invalid secret” warning for a masked secret field when Entra ID options have been obfuscated. [ANY PREMIUM]
    • Fix: Identified a bug where selecting a specific identity provider from a multi-tenant sign-in dropdown when “Use client-side redirect” has been selected, would drop the selected Identity Provider, incorrectly falling back to the default identity provider. [LOGIN]
    • Fix: On a WordPress Multisite installation, the “block direct Media Folder access” feature would generate a download-authorization cookie for one network site and replay it when connected to another network site. Now the service includes a host check, when validating the cookie. [ESSENTIALS, PROFES…
    • Fix: A new installation of the WPO365 | LOGIN plugin will no longer produce an initial “List of pages freed from authentication” with absolute URLs but with site relative paths instead – to prevent a WPO365 Health Message from showing up. [LOGIN]
    • Fix: The SSO bypass cookie (set by the plugin when SSO for the login page is enabled and the correct secret has been added to the login page URL) was being cleared immediately after being set under certain circumstances, preventing the bypass from working beyond the first page load. [ESSENTIALS, PR…
    • Fix: If you have configured multiple Identity Providers, the plugin can now refresh access tokens for users who signed in using a non-default Identity Provider. [LOGIN]
    • This release updates the version numbers of all premium plugins to 44.0 to align with the core plugin WPO365 | LOGIN.

  6. WPO365 43.4

    • Fix: Fixed an issue on WordPress Multisite installations where content embedded from another site could fail to render when WPO365 Audiences was enabled. [ROLES + ACCESS, PROFESSIONAL, CUSTOMERS, INTEGRATE (SYNC, INTRANET)]
    • Fix: Fixed an issue where a double forward slash inside a query string value (e.g. “https://” within a redirect_to parameter) could be incorrectly collapsed to a single slash while the plugin sanitized the current request URL, which could prevent users from signing in successfully. [LOGIN, MAILER]

  7. WPO365 43.3

    • Security Fix: Strengthened verification of certain AJAX requests to help prevent unauthorized changes to plugin settings. [ALL]

  8. WPO365 43.2

    • Fix: Fixed an issue that prevented externally triggered WPO365 User Synchronization jobs from starting via the public “?wpo365_sync_run” endpoint. [INTEGRATE, CUSTOMERS (SYNC, INTRANET)]
    • Fix: Removed support for the LiteSpeed-specific “Secure Download Mode” that relied on the X-LiteSpeed-Location header due to technical issues. [ESSENTIALS, PROFESSIONAL, INTEGRATE, CUSTOMERS (LOGIN+, SYNC, INTRANET)]
    • Fix: Added no-cache headers to responses generated by the custom endpoint that initiates single sign-on, helping prevent client-side caching issues that could result in “nonce not found” exceptions. [LOGIN]

  9. WPO365 43.1

    • Fix: Fixed an issue that could prevent anonymous AJAX requests (admin-ajax.php) from working correctly on WordPress sites that configured WPO365 Intranet Mode. [LOGIN]
    • Fix: Administrators are now allowed to exclude site-relative paths that start with “/wp-admin”. [LOGIN]

  10. WPO365 43.0

    • BREAKING CHANGE: To address multiple vulnerabilities that could allow attackers to bypass WPO365 Intranet Mode, entries in the “Pages freed from authentication” list are now interpreted as server-relative paths. All entries must start with a forward slash (/) and are matched against the beginning o…
    • This release updates the version numbers of all premium plugins to 43.0 to align with the core plugin WPO365 | LOGIN. No functional changes were made to the premium plugins.

  11. WPO365 42.11

    • Change: The plugin will no longer redirect AJAX and REST request to Microsoft but instead return a 401 Unauthorized message and terminate the connection. [LOGIN]
    • Improvement: A new hand-off mode can now be configured for protected Media Library downloads, helping improve performance and the delivery of large files. See updated documentation for details. [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTRANET)]
    • Fix: Fixed Teams silent authentication, which could fail when an internal redirect to the custom SSO endpoint interrupted the authentication response. [LOGIN]
    • Fix: The SCIM manager attribute is now returned as a complex object, in line with Entra ID expectations, to prevent provisioning errors. [SCIM, INTEGRATE, (INTRANET)]
    • Fix: Manager IDs received from Entra ID are now stored as user meta (with key “wpo365_manager_id”). When enabled, the user profile displays a link to view the corresponding WordPress manager. [SCIM, INTEGRATE (SYCN, INTRANET)]
    • Fix: the SCIM userName property’s value is now sourced from Entra ID’s userPrincipalName (by default always stored as user meta with key “userPrincipalName”), replacing the WordPress username – used previously – to prevent mismatches and provisioning errors. [SCIM, INTEGRATE (INTRANET)]
    • Fix: Users deactivated in Entra ID and synchronized as inactive in WordPress are now correctly reactivated in WordPress when re-enabled in Entra ID. [SCIM, INTEGRATE (INTRANET)]
    • Fix: WPO365 Insights will now correctly log all updated user attributes when more than one is patched by the integration with Microsoft Entra ID’s Application Provisioning Service. [SCIM, INTEGRATE (INTRANET)]
    • Fix: A reactivation button is now correctly displayed on the WordPress “Users” page when a user is deactivated and Entra ID Application Provisioning integration is enabled. [SCIM, INTEGRATE (INTRANET)]
    • Fix: The identity provider dropdown on the login page now consistently displays the default placeholder text when multiple providers are configured. [LOGIN]
    • Fix: Fixed broken and outdated links in the plugin wizard. [LOGIN, MAILER]

  12. WPO365 42.10

    • Fix: Updated phpseclib to version 3.0.52 (was 3.0.43), which patches CVE-2026-44167. [LOGIN, MAILER]
    • Fix: Resolved an issue where WordPress 7 styles forced showing an unwanted border on the Toast element (for displaying embed-app errors) [LOGIN, APPS, INTEGRATE (INTRANET)]

  13. WPO365 42.9

    • Fix: Fixed an issue where incorrect URL encoding caused query string parameters to be lost when redirecting users to their originally requested page. [LOGIN]
    • Fix: The plugin will now load modern JavaScript modules correctly on a subdomain-based WordPress Multisite installation, to avoid CORS related issues. [LOGIN]

  14. WPO365 42.8

    • Fix: Improved the interim-login experience when a WordPress session expires. The plugin now detects this scenario earlier and ensures the “Session expired” prompt is shown. [LOGIN]

  15. WPO365 42.7

    • Fix: Resolved an issue that prevented the plugin from forcing Single Sign-on for the login page when a custom authentication scenario WPO_AUTH_SCENARIO has been defined (in wp-config.php). [LOGIN]

  16. WPO365 42.6

    • Fix: Resolved an issue that prevented the plugin for redirecting the user back to the URL they intended to navigate to, before WPO365 initialized SSO and sent the user to Microsoft to authenticate. [LOGIN]

  17. WPO365 42.5

    • Fix: Resolved an issue that prevented Single Sign-On from starting when a custom authentication scenario WPO_AUTH_SCENARIO was defined (in wp-config.php) in combination with using client-side redirection to Microsoft (see option “Use client-side redirect on the plugin’s “Login / logout” configurati…

  18. WPO365 42.4

    • Fix: Resolved an issue that could prevent Single Sign-On from starting when the request URL was altered by plugins, reverse proxies, or subdirectory setups. [LOGIN]

  19. WPO365 42.3

    • Fix: Resolved an issue that prevented Single Sign-On from starting when a custom authentication scenario WPO_AUTH_SCENARIO was defined (in wp-config.php). [LOGIN]

  20. WPO365 42.2

    • Fix: To maintain compatibility with legacy premium Power BI embed-app configurations, the plugin now automatically converts specific string values into arrays when processing manually edited Token Request JSON. [LOGIN]
    • Fix: The body of the email sent when an (OpenID Connect) Application (Client) Secret is about to expire now includes the blog’s name. [LOGIN]

  21. WPO365 42.1

    • Improvement: Redirection to Microsoft for SSO now consistently routes through the plugin’s custom endpoint /wpo/sso/start. This allows administrators to exclude a single endpoint from caching, ensuring reliable nonce verification and preventing cache-related errors such as “Your login has been tamp…
    • Fix: Dynamic tokens such as “wp_user_email” in a custom Power BI token request JSON are once again properly resolved to their corresponding values. [APPS, INTEGRATE (INTRANET)]
    • Fix: Translation for the “Your login has been tampered with” error is now correctly resolved. [LOGIN, MAILER]

  22. WPO365 42.0

    • Change: To improve and streamline the Microsoft Single Sign-On flow, authentication is now consistently initiated via the /wpo/sso/start endpoint (or ?wpo_sso_start=1 without permalinks), and all login buttons have been updated accordingly. See the updated online documentation for details. [LOGIN,…
    • Improvement: You can now send emails from alias addresses when using Microsoft Graph, enabling more tailored and professional communication. Consult the online documentation for details. [MAIL, PROFESSIONAL, INTEGRATE, CUSTOMERS (SYNC, INTRANET)]
    • Improvement: New you can configure the SharePoint Library (premium) embed-app to hide folders and enforce file downloads (instead of opening files in Microsoft 365). [APPS, INTEGRATE (INTRANET)]
    • Improvement: Completely refactored the WPO365 User Synchronization feature for improved reliability e.g. to eliminate caching issues with expired next-links and enhance logging for better diagnostics. [INTEGRATE (SYNC, INTRANET)]
    • Improvement: Users of the new automated embed-app configurator can now duplicate apps – allowing them to effectively create an embed-app template. [LOGIN, APPS, INTEGRATE (INTRANET)]
    • Fix: Nonce handling has been enhanced to prevent caching issues and ensure more secure authentication requests. [LOGIN, MS GRAPH MAILER]
    • Fix: Enhanced Microsoft Teams experience by updating to the latest Microsoft Teams JavaScript SDK. Also refactored existing support for embedded WordPress running in an iframe. [LOGIN]
    • Fix: Media Folder protection now supports query string variables for greater flexibility. Administrators using Apache should reinitialize the feature to apply the required .htaccess updates. [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (SYNC, INTRANET)]
    • Fix: Resolved a race condition in the automated embed-app configurator that could overwrite existing configuration and lead to permission-related issues. [LOGIN, APPS, INTEGRATE (INTRANET)]
    • Fix: Users of the new automated embed-app configurator are now asked to choose between embedding for their organization or for customers to ensure the correct permissions are applied – when applicable. [APPS, INTEGRATE (INTRANET)]
    • Fix: Users of the new automated embed-app configurator for Power BI are now able to configure XmlaPermissions (for Paginated Reports). [APPS, INTEGRATE (INTRANET)]
    • Fix: Resolved several issues affecting configurations with multiple Identity Providers. [ESSENTIALS, PROFESSIONAL, CUSTOMERS, INTEGRATE (LOGIN+, SYNC, INTRANET)]
    • Support for WordPress 7.0.

  23. WPO365 41.3

    • Fix: The Mail Log Viewer now reliably displays attachment names without crashing. [LOGIN, MAILER]
    • Fix: Corrected an issue that could cause a crash while generating client secret expiration warning emails. [LOGIN, MAILER]
    • Fix: Resolved a “Failed to execute ‘querySelector’ on ‘Document'” error in the wizard app triggered by invalid auto-generated element IDs. [LOGIN, MAILER]

  24. WPO365 41.2

    • Fix: Prevented duplicate or incorrect type attributes on script tags, which could cause “Cannot use import statement outside a module” errors. [LOGIN]
    • Fix: Resolved a critical error that could occur when obtaining an access token for an embed-app due to an undefined method call. [LOGIN]
    • Fix: Automatically disables SSO when the mail function is invoked in the context of the WPO365 | MICROSOFT GRAPH MAILER plugin (preventing the plugin from logging unconfigured-warnings). [MAILER].

  25. WPO365 41.1

    • Fix: Prevented duplicate or incorrect type attributes on script tags, which could cause “Cannot use import statement outside a module” errors. [LOGIN]

  26. WPO365 41.0

  27. WPO365 40.3

202514 releases

  1. WPO365 40.2

  2. WPO365 40.1

  3. WPO365 40.0

  4. WPO365 39.0

  5. WPO365 38.0

  6. WPO365 37.2

  7. WPO365 37.1

  8. WPO365 37.0

  9. WPO365 36.2

  10. WPO365 36.1

  11. WPO365 36.0

  12. WPO365 35.0

  13. WPO365 34.2

  14. WPO365 34.1

202419 releases

  1. WPO365 34.0

  2. WPO365 33.3

  3. WPO365 33.2

  4. WPO365 33.1

  5. WPO365 33.0

  6. WPO365 32.0

  7. WPO365 31.1

  8. WPO365 31.0

  9. WPO365 30.2

  10. WPO365 30.1

  11. WPO365 30.0

  12. WPO365 29.0

  13. WPO365 28.2

  14. WPO365 28.1

  15. WPO365 28.0

  16. WPO365 27.2

  17. WPO365 27.1

  18. WPO365 27.0

  19. WPO365 26.0

202322 releases

  1. WPO365 25.4

  2. WPO365 25.3

  3. WPO365 25.2

  4. WPO365 25.1

  5. WPO365 25.0

  6. WPO365 24.3

  7. WPO365 24.2

  8. WPO365 24.1

  9. WPO365 24.0

  10. WPO365 23.0

  11. WPO365 23.1

  12. WPO365 22.1

  13. WPO365 22.0

  14. WPO365 21.8

  15. WPO365 21.7

  16. WPO365 21.6

  17. WPO365 21.5

  18. WPO365 21.4

  19. WPO365 21.3

  20. WPO365 21.2

  21. WPO365 21.1

  22. WPO365 21.0

202219 releases

  1. WPO365 20.4

  2. WPO365 20.3

  3. WPO365 20.2

  4. WPO365 20.1

  5. WPO365 20.0

  6. WPO365 19.4

  7. WPO365 18.0

  8. WPO365 19.3

  9. WPO365 19.2

  10. WPO365 19.1

  11. WPO365 19.0

  12. WPO365 18.2

  13. WPO365 18.1

  14. WPO365 17.5

  15. WPO365 17.4

  16. WPO365 17.3

  17. WPO365 17.2

  18. WPO365 17.1

  19. WPO365 17.0

Questions about WPO365’s releases

What is the latest version of WPO365?

45.2, released on Nov 4, 2026 (5 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is WPO365 updated?

31 releases in the last year, about one every 12 days. Its first release on WordPress.org dates from September 2022.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in WPO365’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.