Release Notes

1.0.2#

Changed

• The Email alerts setting now lists the addresses that will actually receive alerts, including any added or replaced through the abau_notification_recipients filter, and warns when the filter leaves no valid address.
• The daily audit schedule is now checked only on admin and WP-Cron requests instead of on every page view; saving Settings still applies a change immediately.
• The readme's Reports section explains that only the newest audit keeps full ability schemas; older audits in History keep their findings and role matrix.
• Developers: the test suite runs on a plain host WordPress test library (bin/install-host-tests.sh, then composer test) as well as in wp-env; the composer package is now technoleet/ability-auditor.

Fixed

• On PHP 8.4, inventory and audits no longer log a deprecation notice ("Calling ReflectionMethod::__construct() with 1 argument is deprecated") for abilities whose permission or execute callback is a Class::method string. The owner shown in the Inventory tab for such abilities is unchanged.

1.0.0 (2026-10-29)#

First paid release.

New

• Ability inventory: every ability registered through the WordPress Abilities API (6.9+), with its owner plugin, theme or core component, effective REST and MCP exposure, annotations, schemas and category.
• Role permission matrix: each permission_callback is called as a simulated, in-memory Anonymous, Subscriber, Contributor, Author, Editor, Shop manager (with WooCommerce) and Administrator. No ability is ever executed; an execution guard blocks any attempt and the report flags it.
• Rules engine grading findings Critical to Info with plain-language fixes, extensible with the abau_rules filter.
• Tools > Ability Auditor screen with Report, Role matrix, History, Inventory and Settings tabs, and JSON, CSV and print-friendly exports.
• Audit history (last 20 audits) with “new since last audit” highlighting.
• Daily audit and audit after plugin changes with WP-Cron; email alerts only for new high or critical findings.
• WP-CLI: wp ability-audit run [--format=table|json|csv] [--fail-on=...] [--no-save].
• Multisite support: one audit, history and settings per site.
• Licensing and automatic updates through the bundled StoreEngine SDK. Enter your license key under Tools > Ability Auditor License.
• Translations load from the plugin’s languages/ folder; ability-auditor.pot is included.