Release v3.8.7
Paid Memberships Pro v3.8.7
What's new in v3.8.7
Paid Memberships Pro v3.8.7 was released on . The most complete member management and membership subscriptions plugin for WordPress Paid Memberships Pro gives you all the tools you need to start, manage, and grow your membership site. See the full changelog below and compare with the complete version history.
Release details
Released
4.4 MB
File unavailable
Changelog
Other
- SECURITY: Fixed a REST API authorization bypass where route capability checks were case-sensitive while WordPress routes are not. #3823 (@andrewlimaza, @kta1kri)
- SECURITY: PayPal Express, Website Payments Pro, Payflow Pro, and PayPal Standard API requests now verify PayPal's SSL certificate. #3830 (@dparker1005, @kta1kri)
- SECURITY: PayPal gateway error messages for invalid API responses no longer include the API request, which contained the merchant's API credentials. #3830 (@dparker1005, @kta1kri)
- SECURITY: Add On downloads from the license server no longer skip SSL verification and are now always requested over HTTPS. #3831 (@dparker1005, @kta1kri)
- SECURITY: Fixed an issue where the Orders admin search could be used to modify the database query. #3825 (@dparker1005)
- SECURITY: Added nonce checks to the license key form, usage tracking opt-in links, Stripe Connect fee acknowledgement, and several admin notice links. #3826 (@dparker1005)
- SECURITY: Added a missing capability check to the Setup Wizard save handler so it only runs for users with the `pmpro_wizard` capability. #3784 (@faisalahammad)
Added
- Added a Stripe connection test to the payment settings page that checks daily and on demand whether Stripe and the Paid Memberships Pro Connect server can be reached and whether Stripe accepts the saved keys, with an admin notice when a key is rejected. #3792 (@dparker1005)
- Added additional PHP file extensions to the default extension blocklist for the `getfile` script. #3798 (@dparker1005, @kta1kri)
Fixed
- Connecting to Stripe now refuses to overwrite an existing connection with a different Stripe account. #3792 (@dparker1005)
- The Stripe webhook notice no longer reports a missing webhook when Stripe is actually rejecting the saved credentials. #3792 (@dparker1005)
- Refunding an order whose charge was already refunded in the Stripe dashboard now marks the order as refunded instead of failing. #3811 (@dparker1005)
- Fixed Stripe webhook errors for `charge.failed` and `charge.refunded` events when another plugin loads an older version of the Stripe library. #3796 (@faisalahammad)
- Guest comments no longer show the post author's PMPro avatar. #3822 (@flintfromthebasement)
- Membership managers can now print order invoices. #3807 (@faisalahammad)
- The Pay by Check gateway description now reflects that orders are marked as paid at checkout, and links to the Pay by Check Add On for manual payment approval. #3802 (@faisalahammad)
- Fixed quotes in email template variable descriptions showing as HTML entities in the editor autocomplete. #3818 (@dparker1005)
- The required asterisk is now shown only once on radio user fields. #3795 (@faisalahammad)
- Fixed the styling of the Export to CSV button on admin list pages when it is rendered as a button. #3824 (@kimcoleman)
- Expanded rows in the Orders, Members, Subscriptions, and Discount Codes list tables now take the full table width on mobile. #3816 (@faisalahammad, @kimcoleman)
- The PMPro admin banner no longer overlaps the Screen Options and Help tabs on small screens, and list table row actions are tidied on mobile. #3815 (@kimcoleman)
Improved
- Members List username row actions now use the same markup as the other PMPro list tables. #3817 (@kimcoleman)
Removed
- Deprecated `PMPro_AddOns::http_request_args_for_addons()`, which no longer changes request arguments. #3831 (@dparker1005)
Compatibility
- Requires WordPress
- 5.2
- Tested up to
- 7.1
- Requires PHP
- 7.4
Verified safe
Paid Memberships Pro v3.8.7 scanned clean with no security threats detected.
View full scan report