⚠️ This is a beta release. It moves the plugin onto auth0-php v9, which rewrites the Management API. The Authentication flow is unchanged. Please consult the 5.x to 6.x Upgrade Guide before upgrading.

🚀 What's New

This release makes the Auth0 WordPress plugin compatible with auth0-php v9. The plugin's login flow uses the Authentication API, which is unchanged in v9, so authentication requires no changes. The migration is confined to the Management API surface used by background user sync.

✨ Highlights

• 🔑 New getManagement() accessor - Plugin::getManagement() returns a v9 ManagementClient built from your existing plugin configuration (Domain, Client ID, Client Secret), with automatic client credentials token management and caching. It is also available as $this->getManagement() from action and filter classes
• 🏗️ auth0-php v9 Management API - Strongly-typed requests and responses, sub-clients accessed as properties ($management->users->list()), and built-in Pager<T> pagination
• 🔁 More resilient user sync - Background sync now retries transient Management API failures (429, 5xx) on the next cron pass instead of dropping the queued event
• 🛡️ Authentication unchanged - Login, logout, the callback handler, and session handling behave exactly as in 5.x

🔄 What's Changed

The Authentication surface is completely unchanged. Login, logout, callback, and session handling work exactly as before.

The Management API entry point has changed for any custom code that calls it:

getSdk()->management() is non-functional with auth0-php v9 and throws a TypeError. Use getManagement() instead.

📦 Installation

This beta is distributed as a signed zip on the GitHub release, not through the WordPress.org plugin directory. Download Auth0_WordPress_6.0.0-beta.0.zip from the release assets and upload it via Plugins → Add New → Upload Plugin in wp-admin. It is also resolvable through Composer:

composer require auth0/wordpress:6.0.0-beta.0

⚠️ Breaking Changes

• Bumped the auth0/auth0-php dependency from ^8.19 to ^9.0
• Raised the minimum PHP version from 8.1 to 8.2
• getSdk()->management() is non-functional with auth0-php v9. Use the new getManagement() accessor instead

📚 Resources

• 5.x to 6.x Upgrade Guide
• auth0-php v9 Migration Guide
• auth0-php v9 API Reference

🙏 Feedback

This is a beta release - we would love your feedback! Please open an issue if you encounter any problems or have suggestions.

Fixed

• fix: Enforce allow_fallback setting during authentication

Fixed

• Security fix: Resolve CVE-2026-34236

Fixed

• Security fix: Resolve CVE-2025-68129

Fixed

• Security fix: Resolve CVE-2025-58769

Fixed

• Security fix: Resolve CVE-2025-47275

Full Changelog

Fixed

• Resolved an issue with corrupted JSON payloads.

Changed

• Tested against WordPress 6.5.5 w/ PHP 8.3.
• Improved translated string handling.

Fixed

• Resolved issue with ?wle parameter handling.

Fixed

• Resolves an issue in which the fallback URI secret isn't shown. #903 (HPiirainen)
• Resolves a compatibility issue with changes in WordPress 6.5 causing invalidated sessions. (evansims)

Full Changelog

Added

• Add support for Wordpress 'reauth' #877 (PeterGFernandez)

Changed

• PHP 8.0+ compatibility improvements #878 (PeterGFernandez)
• Remove Initial Setup Wizard #886 (evansims)

You can verify the signature of a downloaded release archive using OpenSSL. Download the public signing key from the GitHub repository and save it to the same directory as the .ZIP and .SIGN files provided with this release, then run the following:

openssl dgst -verify public-signing-key.pub -keyform PEM -sha256 -signature Auth0_WordPress_Plugin_4.6.0.zip.sign -binary Auth0_WordPress_Plugin_4.6.0.zip