Conversation
supportHello, because of the last update, there is an error for every PHP Snippet: Error: PHP snippet execution requires administrator privileges. is this a permanent error, or is it a bug that is fixed nearby?
i put it back to 4.0.12 too, on all of my 90 WP-Websites. But hopefully there will soon be a final official solution through version 4.0.14.
Hi @hk-orga , Thank you for reaching out and for reporting the issue. The error you encountered, “PHP snippet execution requires administrator privileges” , has now been fixed. Please update the plugin using the build we’ve provided and let us know your feedback after testing. Once we receive your confirmation, we’ll proceed with releasing the update publicly. You can download the updated plugin from the link below: https://drive.google.com/file/d/1QF_xAzzHTeCs8co6QPsmb4Hex5apfbyZ/view?usp=sharing We look forward to your feedback. Thanks & regards, WPExperts Support Team
it seems that the variables in the code snippet are not interpretet, the result is $attr_ + var_name. Did you changed the variable name handling from {var_name} to something new?
Hi @hk-orga , I can confirm that yes, there was a recent change to how variables are handled in PHP snippets, which is causing the behavior you’re experiencing. What Changed: In the plugin we implemented a security fix that changed how variables are processed in PHP-enabled snippets. Old Behavior (Before the Fix): Variables used the format: {var_name} The plugin would directly substitute the user input into the snippet content Example: {name} would be replaced with the actual value like “John” New Behavior (Current): Variables still use the format: {var_name} in your snippet definition However, for PHP snippets, the plugin now converts them to PHP variables with an attr_ prefix Example: {name} is now converted to $attr_name before PHP execution php // e.g. echo “{name}”; becomes echo “$attr_name”; Why This Change Was Made: This was a critical security fix. How to Fix Your Snippets: You need to update your PHP snippets to use the new variable format: Old format: php echo “Hello {name}!”; New format (required now): php echo “Hello $attr_name!”; Important: For non-PHP snippets, the old {var_name} format still works normally Only PHP-enabled snippets require the $attr_ prefix Summary: The variable handling did not change from {var_name} to something new in terms of how you define them in the snippet settings. You still define variables the same way. However, within PHP snippet code, you must now reference them as $attr_var_name instead of {var_name}. This change was necessary for security. Thank you
Hi @hk-orga , Just a quick update. We will be closing this thread for now. If you have any further questions or need assistance, please feel free to open a new thread and we will be happy to help. Best regards, WPExperts Support Team
i put it back to 4.0.12 too, on all of my 90 WP-Websites. But hopefully there will soon be a final official solution through version 4.0.14.
Hi @hk-orga , Thank you for reaching out and for reporting the issue. The error you encountered, “PHP snippet execution requires administrator privileges” , has now been fixed. Please update the plugin using the build we’ve provided and let us know your feedback after testing. Once we receive your confirmation, we’ll proceed with releasing the update publicly. You can download the updated plugin from the link below: https://drive.google.com/file/d/1QF_xAzzHTeCs8co6QPsmb4Hex5apfbyZ/view?usp=sharing We look forward to your feedback. Thanks & regards, WPExperts Support Team
it seems that the variables in the code snippet are not interpretet, the result is $attr_ + var_name. Did you changed the variable name handling from {var_name} to something new?
Hi @hk-orga , I can confirm that yes, there was a recent change to how variables are handled in PHP snippets, which is causing the behavior you’re experiencing. What Changed: In the plugin we implemented a security fix that changed how variables are processed in PHP-enabled snippets. Old Behavior (Before the Fix): Variables used the format: {var_name} The plugin would directly substitute the user input into the snippet content Example: {name} would be replaced with the actual value like “John” New Behavior (Current): Variables still use the format: {var_name} in your snippet definition However, for PHP snippets, the plugin now converts them to PHP variables with an attr_ prefix Example: {name} is now converted to $attr_name before PHP execution php // e.g. echo “{name}”; becomes echo “$attr_name”; Why This Change Was Made: This was a critical security fix. How to Fix Your Snippets: You need to update your PHP snippets to use the new variable format: Old format: php echo “Hello {name}!”; New format (required now): php echo “Hello $attr_name!”; Important: For non-PHP snippets, the old {var_name} format still works normally Only PHP-enabled snippets require the $attr_ prefix Summary: The variable handling did not change from {var_name} to something new in terms of how you define them in the snippet settings. You still define variables the same way. However, within PHP snippet code, you must now reference them as $attr_var_name instead of {var_name}. This change was necessary for security. Thank you
Hi @hk-orga , Just a quick update. We will be closing this thread for now. If you have any further questions or need assistance, please feel free to open a new thread and we will be happy to help. Best regards, WPExperts Support Team