AccessAlly 4.9.2

Released September 8, 2026

Security

• We corrected how AccessAlly issues the WordPress login cookie in four places where it signs a member in. Those places were sending the cookie without the Secure attribute, which tells the browser to send it only over an encrypted connection, even on sites correctly served over HTTPS. AccessAlly now leaves that decision to WordPress itself, so the cookie is marked Secure wherever WordPress determines it should be.

Bug fixes

• We fixed new customers being unable to set their password on the purchase success screen. The password form reported a security error, the password was never saved, and the customer finished checkout without a working login. If you saw error code 09016 on that screen, this is the cause and it is now resolved.
• We fixed the “Invalid Subscription ID.” and “Invalid Order ID.” messages that appeared on the Sales page as soon as it loaded. The Order ID and Subscription ID boxes were being pre-filled with a zero rather than left empty, so the page searched for a record that does not exist before you had typed anything. This was the known issue listed with the 4.9.1 release, and both boxes now start empty.
• We fixed members being logged out, or seeing a security error, after changing their password through an AccessAlly profile block. Changing a password ends the member’s existing session by design, and AccessAlly was not establishing the new one for the rest of that page load, so the next save on the same form failed its security check. Every place the plugin signs a member in now goes through one shared routine that establishes the session properly.

Known issue

On some sites the WordPress Plugins screen shows a fatal error instead of loading. It can also appear when a security plugin runs a full scan, because that asks WordPress for AccessAlly’s plugin information. Your site, your members and your data are not affected, and nothing on the front end stops working, but the Plugins screen itself becomes unusable while it happens. The cause was introduced in 4.9.0, we have identified it, and a fix is in progress. If this is affecting you, please contact our support team and we will get you sorted in the meantime.