EMCP Themer has been able to route templates since 3.1.0: build a header, a footer, a single-post layout, decide where each one applies, and the plugin puts them on the front end. The routing was never the problem. Running out of parts was.
You would start a Single template, drop in a title, and then want an author box. There isn’t one. A previous and next link. Not there. Comments, a search form for the 404, a metadata row in the order you actually want it. All missing, because classic themes do not ship those pieces and Elementor charges for the equivalents.
3.13.0 fills that gap, and then removes the bigger one underneath it.
Nine widgets, so the template can actually be finished
Author Box, Post Navigation, Post Comments, Search Form, Sitemap, Post Info, Archive Posts, Featured Image and Post Excerpt. All free.
They are not thin wrappers. Author Box shows the avatar, name, biography and links, with every part switchable. Post Navigation can stay within the same category, which is what makes it useful on a site running several content streams. Post Info builds an ordered metadata row: author, date, time, comment count, terms, or a custom field, in the order you list them. Archive Posts adds pagination, which is what the original loop element was missing. And Search Form is the small one that finally makes a 404 template worth building.
Author Box and Sitemap also ship as blocks. Comments, search and post navigation do not, because WordPress core already has a block for each and duplicating them would just be noise.
Nothing you have already built changes. Post Info and Archive Posts sit beside Post Meta and Archive Loop rather than replacing them, so existing templates render exactly as they did. The old loop element is relabelled “Archive Posts (classic)” so you can tell the two apart in the panel.
While you are editing a theme template, the EMCP Themer category now sits at the top of the Elementor panel instead of near the bottom. On an ordinary page it stays where it was, and the widgets are still available there: a sitemap, search form or posts grid is useful outside a template too.
Dynamic data, on free Elementor
The deeper change is that you stop hunting for a special widget at all.
Pick the source from the field itself. In Elementor it appears in the dynamic picker on any field that accepts one. In the block editor it binds to a Heading, Paragraph, Image or Button. A heading shows the post title. An image shows the featured image. A button links to the post.
Here is the part worth knowing: Elementor ships the machinery for dynamic fields but none of the sources. On a free install that picker exists and is empty. EMCP fills it. Ten sources are free: post title, post excerpt, post URL, post date, post ID, featured image, archive title, site title, site logo and the site description. Pro adds the ones that need configuring, plus a fallback for when a field comes back empty: custom fields (ACF-aware), author name, bio, URL and avatar, and taxonomy terms.
Sources are typed, and the type is enforced. An image source cannot be bound to a heading. A binding that cannot work is refused when you make it, rather than rendering blank later and leaving you to work out why.
Your AI can build dynamic templates too
A new list-dynamic-sources tool tells a connected agent what this site offers and what each source produces, and the existing widget and block tools accept a binding alongside the usual settings. It reports only the surfaces a source really has, so an agent is never sent looking for a block that was never registered.
A rewritten SQL guard
The other half of this release started as a patch for an external audit of 3.12.3 and turned into a rewrite.
The read-only database guard used to normalise a query into a plain string and pattern-match it. That only works while the guard reads a query the same way MySQL does. Five review rounds found four places where it did not, three of which could expose data from the user table.
The guard now splits a query into typed pieces and inspects those, so a table name inside quotes is a piece of text whatever characters surround it. Anything it cannot account for is refused outright instead of guessed at, and a query is allowed only if it is safe under every way the server could read it. Server system tables are off limits now too. Ordinary reporting queries are unaffected.
Command-line AI apps can sign in again
Codex and similar tools registered fine, reached the sign-in page, and were then turned away with “Invalid client or redirect URI”.
The cause was the check on the address the app returns to. A command-line app listens on your own machine and can spell that machine three ways (localhost, 127.0.0.1, ::1) on a port it picks fresh each run. The check tolerated the changing port but insisted the spelling match exactly, so an app that registered one spelling and signed in with another was refused even though both point at the same place. All three are now treated as the same machine. Addresses that leave your machine, including every https one, are still matched exactly as before.
Get it
Update from your WordPress dashboard, or grab the release from GitHub. The widgets, the dynamic sources listed as free, and the whole Themer engine are free. Pro adds the configurable sources, the empty-field fallback, unlimited templates per type, and granular display conditions.