Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

WPO365 · Version history

WPO365 changelog and version history

Latest version
6.4
Nov 4, 2026 (5 days ago)
Releases
62
since 2022
In the last year
18
about one every 21 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 20226 releases
  • 202317 releases
  • 202414 releases
  • 20259 releases
  • 202616 releases

202616 releases

  1. WPO365 6.4Latest

    • Security: Hardened the nonce check of the mail authorization.
    • Security: Updated phpseclib to version 3.0.58 (was 3.0.52).
    • Fix: On websites with a persistent object cache (e.g. Redis or Memcached), the WPO365 configuration no longer shows premium features as locked when the cache held an outdated list of active premium plugins. Opening the configuration, the “Verify license and check for plugin updates” button on the L…

  2. WPO365 6.3

    • Fix: When a WordPress session expires, WordPress’ own login prompt appears again, instead of the website’s home page opening in that prompt.
    • Security: Hardened how WPO365 processes the response of a mail authorization.
    • Security: Fixed a cross-site scripting (XSS) vulnerability.
    • Improvement: When a mail authorization fails because a nonce could not be verified, WPO365 now writes to its log why (e.g. the authorization link had been used before, or was not created by this website).
    • Fix: On WordPress multisite networks, activating, deactivating or updating a WPO365 premium plugin network-wide now refreshes every site’s list of active premium plugins, so that the premium options appear in each site’s configuration.
    • Fix: For a “Government GCC (High)” tenant, WPO365 now reads the expiration date of the application secret from graph.microsoft.us instead of graph.microsoft.com, where the request failed with “SecurityTokenInvalidCloudInstanceException”.

  3. WPO365 6.2

    • Security: Fixed a cross-site scripting (XSS) vulnerability.
    • Security: Hardened the “Licenses” page. License requests to wpo365.com now also verify the server’s SSL certificate, unless “Skip SSL host verification” is checked on the plugin’s “Miscellaneous” configuration page.
    • Security: The ID token received while authorizing the mail account is now always checked for the right issuer and audience.
    • Fix: License keys are now saved in the database only. Any license key in your wp-config.php overrides (WPO_OVERRIDES) will be automatically copied to the database once and then ignored.

  4. WPO365 6.1

    • Fix: Microsoft’s infrastructure is currently incompatible with OpenSSL 3.5 and higher’s new default settings (as shipped with e.g. Debian 13), which could make sending emails via Microsoft Graph unexpectedly fail with a “Not Found” error on affected web hosts (e.g. IONOS / Fasthosts) – the plugin n…

  5. WPO365 6.0

    • Support for WordPress 7.1.
    • The plugin will now – on a daily base – automatically refresh the Microsoft Graph mail connection’s access and refresh token, so outgoing mail no longer risks failing due to a long-expired token after periods of low activity. Consult the update tutorial
    • Added automatic detection and suppression of duplicate outgoing emails sent within a short time window. Read more
    • The plugin’s built-in “Send WordPress emails using Microsoft Graph” feature nows honor a “Retry-After” header – when Microsoft Graph throttles a request – with a short automatic retry, instead of failing immediately. Read more
    • The existing “obfuscate Entra ID options” switch – that will delete sensitive Entra ID settings from the database once they’re defined in ‘wp-config.php’ when toggled on – is now capable of automatically restoring those settings if switched off again. Read more

  6. WPO365 5.10

    • Fix: Fixed an issue where a double forward slash inside a query string value (e.g. “https://” within a redirect_to parameter) could be incorrectly collapsed to a single slash while the plugin sanitized the current request URL, which could prevent users from authorizing successfully. [LOGIN, MAILER]

  7. WPO365 5.9

    • Security Fix: Strengthened verification of certain AJAX requests to help prevent unauthorized changes to plugin settings.

  8. WPO365 5.8

    • Fix: Refactored and updated core elements to improve overall security, maintainability and resilience. No functional changes.

  9. WPO365 5.7

    • Fix: Fixed broken and outdated links in the plugin wizard.

  10. WPO365 5.6

    • Fix: Updated phpseclib to version 3.0.52 (was 3.0.43), which patches CVE-2026-44167.

  11. WPO365 5.5

    • Improvement: Redirection to Microsoft for SSO / Authorization now consistently routes through the plugin’s custom endpoint /wpo/sso/start. This allows administrators to exclude a single endpoint from caching, ensuring reliable nonce verification and preventing cache-related errors such as “Your log…

  12. WPO365 5.4

    • Improvement: You can now send emails from alias addresses when using Microsoft Graph, enabling more tailored and professional communication. Please note that this is a premium function. Consult the online documentation for details.
    • Support for WordPress 7.0.

  13. WPO365 5.3

    • Fix: The Mail Log Viewer now reliably displays attachment names without crashing.
    • Fix: Corrected an issue that could cause a crash while generating client secret expiration warning emails.
    • Fix: Resolved a “Failed to execute ‘querySelector’ on ‘Document'” error in the wizard app triggered by invalid auto-generated element IDs.

  14. WPO365 5.2

    • Fix: Automatically disables SSO when the mail function is invoked in the context of the WPO365 | MICROSOFT GRAPH MAILER plugin (preventing the plugin from logging unconfigured-warnings). [MAILER].

  15. WPO365 5.1

    • Fix: Prevented duplicate or incorrect type attributes on script tags, which could cause “Cannot use import statement outside a module” errors. [MAILER]

  16. WPO365 5.0

    • Change: Redesigned the menu of the plugin’s Configuration Pages – new with a new vertical navigation, Redesigned the plugin menu with a new vertical navigation, improving clarity and access to features. [ALL]
    • Improvement: To align with Microsoft’s current branding, Azure AD has been renamed to Microsoft Entra ID throughout the plugin, and all portal links now open in entra.microsoft.com. [ALL]
    • Fix: Fixed an issue in the stand‑alone WPO365 | MICROSOFT GRAPH MAILER plugin and tested and confirmed compatibility with GCC High tenants. [MAILER]

20259 releases

  1. WPO365 4.2

    • Security Fix: A Server Side Request Forgery (SSRF) vulnerability has been patched. [ALL]
    • Improvement: Confirms support for WordPress 6.9. [ALL]

  2. WPO365 4.1

    • Improvement: When emails are successfully sent during a retry, the corresponding error message is removed, and the error count on the WPO365 | INSIGHTS Dashboard is updated accordingly.
    • Improvement: Sending WordPress emails via Microsoft Graph is now supported for GCC High tenants.

  3. WPO365 4.0

    • Feature: See what matters, when it happens Track key WPO365 events like sent emails with WPO365 Insights and get alerted when when a critical WPO365 event occurs. Consult the updated documentation for instructions how to configure WPO365 Alerts. [ALL PREMIUM]
    • Improvement: A new Daily WPO365 Insights widget has been added to the WP Admin Dashboard, informing administrator about key WPO365 events like logins, sent emails and user creation and updates. Refer to the update documentation for further details or how to hide the widget. [ALL]
    • Fix: The plugin checks whether the request parameter with the key idp_id was added by WPO365, and ignores it if not. [ALL PREMIUM]
    • Fix: Addressed various technical problems to enhance plugin reliability. [ALL]

  4. WPO365 3.7

    • Fix: WPO365 will avoid using “wp_print_inline_script_tag” and instead create a

  5. WPO365 3.6

    • Improvement: The built-in WordPress Mailer for Microsoft Graph now supports RBAC for Exchange Online. As a result, administrators should now explicitely configure the desired authorization scenario, as explained in a new lesson in the tutorial.
    • Improvement: All scripts now are created using either wp_print_script_tag or wp_print_inline_script_tag. As a result, developers can add your own nonce attribute using the wp_script_attributes and wp_inline_script_attributes filters e.g. to enable a Content-Security-Policy (or CSP).
    • Fix: For premium plugins, WPO365 would check the license status with every admin request, which could slow down your site unnecessarily. [MAIL]

  6. WPO365 3.4

    • Fix: The TLD “lan” has been added to the license-checker list of exceptions.
    • Fix: An issue causing – under specific circumstances – an “array-to-string conversion” warning in the Url_Helpers class has been resolved.

  7. WPO365 3.3

    • Improvement: All source-code is now constantly reviewed for violations of coding standards (using phpcs) and if possible corrected to adhere to the WordPress Coding Standards.
    • Fix: Functionality to save the state before the user is sent to Microsoft to authenticate and to read that state when the user returns has been refactored, to ensure redirection back to the “intended” location before WPO365 sent the user to Microsoft is working as expected.
    • Fix: WPO365 will no longer show a “doing_it_wrong” warning when installed for the very first time.
    • Fix: During the previous release, premium plugins were not zipped correctly, causing issues with folder-naming when installing. [ALL PREMIUM]

  8. WPO365 3.2

    • Fix: (Composer) Dependencies have been updated to remove the requirement for PHP >= 8.0.0.

  9. WPO365 3.1

    • Improvement: You can now choose between a Microsoft 365 account or a personal Microsoft account, like Hotmail.com or Outlook.com, to send WordPress emails. See the updated tutorial for details.
    • Fix: Plugin no longer (falsely) reports an error when enabling the auto-retry mail-send functionality fails. Instead, it generates a warning with a more verbose description. [MAIL]
    • Fix: The plugin now properly URL encodes a user’s UPN when trying to submit email messages to Microsoft Graph. [LOGIN, MICROSOFT GRAPH MAILER

202414 releases

  1. WPO365 3.0

  2. WPO365 2.39

  3. WPO365 2.38

  4. WPO365 2.37

  5. WPO365 2.36

  6. WPO365 2.35

  7. WPO365 2.34

  8. WPO365 2.33

  9. WPO365 2.32

  10. WPO365 2.31

  11. WPO365 2.30

  12. WPO365 2.29

  13. WPO365 2.28

  14. WPO365 2.27

202317 releases

  1. WPO365 2.26

  2. WPO365 2.25

  3. WPO365 2.24

  4. WPO365 2.23

  5. WPO365 2.21

  6. WPO365 2.20

  7. WPO365 2.19

  8. WPO365 2.18

  9. WPO365 2.17

  10. WPO365 2.16

  11. WPO365 2.15

  12. WPO365 2.14

  13. WPO365 2.13

  14. WPO365 2.12

  15. WPO365 2.11

  16. WPO365 2.10

  17. WPO365 2.9

20226 releases

  1. WPO365 2.8

  2. WPO365 2.7

  3. WPO365 2.6

  4. WPO365 2.5

  5. WPO365 2.4

  6. WPO365 2.3

Questions about WPO365’s releases

What is the latest version of WPO365?

6.4, released on Nov 4, 2026 (5 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is WPO365 updated?

18 releases in the last year, about one every 21 days. Its first release on WordPress.org dates from September 2022.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in WPO365’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.