Changelog

6.0.8 2026-11-01

Fixed

• Fixed dynamic values such as {cpTrigger} and {siteUrl} not being parsed in SSL routing settings, which caused a /{cpTrigger} restricted URL to force SSL across the whole site.

6.0.7 2026-10-07

Changed

• Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (verbb-base#3 (opens new window))

6.0.6 2026-10-05

Fixed

• Fixed a moderate-severity HTTPS enforcement bypass vulnerability.
• Fixed a low-severity credential exposure vulnerability.

6.0.5 2026-10-02

Changed

• Updated the required version of verbb/base to 3.0.19.

Fixed

• Fixed a moderate-severity authorization bypass vulnerability.
• Fixed a low-severity open redirect vulnerability.
• Fixed a low-severity hard-coded credential vulnerability.

6.0.4 2026-09-30

Changed

• Route plugin settings through the plugin’s authorized settings controller.

Fixed

• Fixed a high-severity access control vulnerability.

6.0.3 2026-09-14

Changed

• Updated documentation for clearer, more consistent guidance.

6.0.2 2026-09-13

Changed

• Normalize plugin settings.

6.0.1 2025-07-18

Changed

• Update English translations.
• Update non-English translations.

6.0.0 2024-05-13

Changed

• Now requires PHP 8.2.0+.
• Now requires Craft 5.0.0+.