Fatal Error last Update

Hi,

unfortunately, version 3.2.5 introduces another critical regression.

After updating from 3.2.4 to 3.2.5, WordPress login fails with the following message:

Error: Cookies are blocked due to unexpected output.

The same unexpected output also causes several WordPress admin pages to load as blank or incomplete pages.

Reverting to version 3.2.4 immediately resolves the issue.

I compared both plugin versions and found the cause. In version 3.2.5, at least 37 PHP files now begin with this pattern:

<?php if ( ! defined( 'ABSPATH' ) ) exit; ?>

<?php

One affected file is:

includes/xoo-framework/xoo-framework.php

Because the first PHP block is closed with ?>, the line breaks between the two PHP blocks are sent as output. Since xoo-framework.php is loaded during normal plugin initialization, output is generated before WordPress can send login cookies and HTTP headers.

The guard should remain inside a single PHP block, for example:

<?php

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

The file should then continue without closing and reopening PHP.

Please check all files where the new direct-access protection was added. The problem is not limited to one template file; the same pattern occurs throughout the plugin package.

This appears to have been introduced as part of the security-related changes in 3.2.5.

For context, the previous release already caused customer registration to fail because WP_Error was referenced inside the XooEL\Aff namespace without the global namespace prefix. You provided version 3.2.4 after I reported that issue, and that version currently works.

Could you please release a corrected update that includes both fixes and test the following before publishing it?

• WordPress login via /wp-login.php
• WooCommerce customer registration
• Easy Login AJAX registration
• WordPress admin React pages
• AJAX and REST responses
• PHP 8.4 compatibility

Thanks.

Hi,

thanks for sending version 3.2.6.

I checked the package, and the previous WP_Error namespace issue appears to be fixed correctly:

$errors = new \WP_Error();

However, version 3.2.6 still contains the unexpected-output problem that can prevent WordPress from setting login cookies and can corrupt AJAX or REST responses.

In around 30 PHP files, the following pattern is still present:

<?php if ( ! defined( 'ABSPATH' ) ) exit; ?>

<?php

The closing ?> followed by a new PHP block outputs the line break between the blocks.

One directly affected file is:

includes/class-xoo-el-helper.php

This file produces a CRLF line break before WordPress can send HTTP headers. This can cause:

• “Cookies are blocked due to unexpected output”
• failed WordPress logins
• broken AJAX or REST responses
• blank or incomplete WordPress admin pages

The direct-access guard should remain within the same PHP block:

<?php

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

Please check the entire plugin package and remove the closing and reopening PHP tags from all affected files, not only one specific file.

I tested a locally corrected version with all affected transitions removed, and it no longer produces unexpected output.

Yes perfect. Everything seems to be working again.