WP Sudo 4.1.0 — security hardening

[dknauss]

Security-hardening release. Requires WordPress 6.4+, PHP 8.2+.

• Gate-completeness fixes (coordinated disclosure; affected versions ≤ 4.0.0): interactive effect-level backstop on admin_init + login-session binding of the sudo proof (fix(gate): close two action-gating completeness gaps (CVD) #102); REST effect-level backstop for custom routes (feat(gate): REST effect-level backstop + audit methodology (deferred #102 follow-ups) #104).
• Admin-escalation guard (opt-in, default OFF): refuses to grant a new administrator/super-admin without an active sudo session — hooks the capabilities-meta write + grant_super_admin, so it covers REST/AJAX/unauthenticated paths. Filters wp_sudo_guard_escalation / wp_sudo_allow_escalation, constant WP_SUDO_ALLOW_ESCALATION, high-severity wp_sudo_escalation_blocked event. Known limits: runtime user_has_cap/map_meta_cap grants and direct $wpdb writes are not caught (feat(security): role-aware admin-escalation guard with App-Password policy deference #111).
• Docs aligned with shipped code (docs: align docs with shipped 4.1.0 code and prep release #113); Playground demo link bumped (docs(readme): point latest-release Playground link at v4.1.0 #114).

Full notes: see CHANGELOG.md (## 4.1.0).

---

This discussion was created from the release WP Sudo 4.1.0 — security hardening.