Pantheon release notes

Pantheon has released version 2.3.4 of the WP SAML Auth WordPress plugin.

Version 2.3.3 was released on August 11, 2026 with a security fix for SAML user matching. The 2.3.3 package published to the WordPress Plugin Repository was missing its vendor directory, which includes the bundled onelogin/php-saml library, so sites that took that update could not authenticate through SAML. Version 2.3.4 was released the following day to correct the packaging, and it carries the 2.3.3 security fix as well. Both releases are one day apart, so a site may be on either version depending on when it last updated.

What's new

• Security: user matching now accent-sensitive — Fixes an account takeover where an accent-insensitive database collation could match a SAML attribute to the wrong WordPress user. User lookup is now verified with a case-insensitive, accent-sensitive comparison. Originally released in 2.3.3.
• Restores the bundled SAML library — The vendor directory, which includes onelogin/php-saml, is included in the package again. Sites affected by 2.3.3 will be able to authenticate through SAML after updating.

Who is affected

• Sites on 2.3.2 or earlier are missing the security fix and should update to 2.3.4.
• Sites on 2.3.3 installed from the WordPress Plugin Repository, using the WordPress dashboard, WP-CLI, or the direct download, have the security fix but may be unable to authenticate through SAML. Update to 2.3.4 to restore login.
• Sites that install the plugin with Composer are unaffected by the packaging issue, because onelogin/php-saml is resolved as a dependency rather than from the bundled copy. These sites should still update to 2.3.4 if they are on 2.3.2 or earlier.

Update to 2.3.4 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin release notes.

Pantheon has released version 2.3.2 of the WP SAML Auth WordPress plugin. This security update fixes vulnerabilities in the robrichards/xmlseclibs and onelogin/php-saml dependencies. For more information, see the plugin release notes for details.

Update to 2.3.2 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

The Pantheon MU Plugin v1.5.6 is now available.

WordPress sites can apply this update by applying upstream updates from the dashboard or via Terminus. WordPress (composer managed) sites can upgrade using composer update or by checking for updates in the dashboard.

Revised MU Plugin update strategy

Starting with this release, MU Plugin updates are deployed as standalone commits to the WordPress upstream, independent of WordPress core version updates. WordPress sites will now receive MU Plugin updates more frequently and as discrete, visible changes in the dashboard — rather than bundled with core version bumps.

What's new?

This release spans two MU Plugin versions, with updates concerning WordPress sites running Elasticsearch on Pantheon:

1.5.5

• Fixes an issue where wp elasticpress sync CLI commands indexed content with http:// image URLs instead of https://, causing broken images on the HTTPS frontend. A pantheon_elasticpress_force_https_in_cli filter is available for sites that need to opt out of this behavior.

1.5.6

• Fixes ElasticPress Autosuggest and Instant Results on sites using ElasticPress.io by routing browser-side search requests to the public host rather than an internal proxy URL that browsers cannot reach.

WordPress upstream

• WP_HOME and WP_SITEURL definitions in wp-config-pantheon.php are now conditional, so customer-defined values are respected and PHP notices are no longer generated when these constants are already set before wp-config-pantheon.php is included.

Pantheon has released version 2.3.1 of the WP SAML Auth WordPress plugin. This update adds a new filter for multisite environments to give developers more control over how SAML-provisioned users are added to sites. No action is required — existing behavior is unchanged.

What's new

• Multisite user provisioning control — A new wp_saml_auth_auto_add_to_blog filter allows developers to prevent auto-provisioned SAML users from being automatically added to the current site. When set to false, users are created as network-level users without a role on any specific site, giving full control over site membership. The filter defaults to true, preserving existing behavior. See #465 for details.

Update to 2.3.1 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin changelog.

Version 1.3.5 of the Pantheon Content Publisher WordPress plugin is now available.

What's new?

• ACF integration — Sync Content Publisher metadata fields to Advanced Custom Fields. Define field mappings per post type in the plugin's Integration tab and metadata values are automatically applied on every publish.
• Custom post type support — Publish content to any public post type registered on your WordPress site. Administrators can set the target post type per collection, or select "Chosen by the author" to let document authors control it via the wp-post-type metadata field.

Update to 1.3.5 from the WordPress dashboard under Plugins > Installed Plugins, or download it from the WordPress Plugin Repository.

For more details, see the plugin changelog.

We are pleased to announce that all of our actively maintained WordPress plugins are now confirmed fully compatible with WordPress 6.9.

Actively Maintained Plugins

The following plugins have been tested and verified for compatibility:

• WP SAML Auth
• Pantheon Advanced Page Cache
• Pantheon HUD
• Native PHP Sessions
• Pantheon Content Publisher
• WP Redis

Action Required

We recommend updating your Pantheon plugins to their latest versions alongside your WordPress 6.9 core upgrade. This ensures you receive the latest performance optimizations, security patches, and full compatibility with PHP 8.4.

As a best practice, always test these updates in a Dev or Multidev environment before deploying to Live.

The Pantheon Content Publisher plugin is now officially available in the WordPress Plugin Repository. You can now install or update it directly from your WordPress dashboard.

Action required

We recommend that all customers switch their sites to the WordPress.org–hosted version to take advantage of seamless updates and improved long-term support. By switching, you’ll:

• Receive automatic update notifications and one-click upgrades within the WordPress admin panel
• Stay up to date with the latest security, stability, and compatibility improvements
• Benefit from WordPress’s official distribution system, including built-in changelogs, and version tracking

Switching to the repository version helps ensure your site runs the most stable and officially supported release of the plugin.

Pantheon has released a new version of our Native PHP Sessions plugin. This release updates documentation and a number of minor dependencies under the hood. Most notably, this update tests the plugin against PHP 8.4, increases the minimum PHP version to 7.4 and bumps the minimum supported WordPress version to 5.3. Additionally, to comply with WordPress plugin repository guidelines, we have removed "WordPress" from the plugin name.

Action required

You are encouraged to upgrade your version of Native PHP Sessions to the latest version as soon as you are able.

If you have issues with the plugin, please use the GitHub issue queue for the plugin.