Security fix: unauthenticated /wp-admin requests were being redirected through the custom login URL slug, exposing it to anyone probing the default admin path and defeating the purpose of hiding the login URL. Blocked access now redirects to the homepage instead.
Fixed: the custom login URL feature was incorrectly intercepting admin-ajax.php and admin-post.php requests, breaking public AJAX/form submissions (contact forms, popups, WooCommerce) for logged-out visitors.
Fixed: Spam Filter “Detect code/script content” level selector was unreachable while its toggle was off, its dropdown menu could be clipped, and its on/off label could fail to update on click due to a JS scoping bug affecting all Spam Filter toggles.
4.7.1
Fixed: fatal PHP parse error on PHP 7.4 servers caused by a PHP 8.0-only match() expression in the AI Payment verified-stats handler; replaced with a switch statement for broad host compatibility.
4.7
Added AI Hub module with multi-provider support (Gemini, Claude, OpenAI) and 3-tier fallback chain.