Release v3.9
Paid Memberships Pro v3.9
Latest versionWhat's new in v3.9
Paid Memberships Pro v3.9 was released on . The most complete member management and membership subscriptions plugin for WordPress Paid Memberships Pro gives you all the tools you need to start, manage, and grow your membership site. See the full changelog below and compare with the complete version history.
Release details
Released
4.6 MB
File available
Changelog
Other
- SECURITY: Improved escaping and SQL query preparation throughout the plugin. #3827 (@dparker1005)
- SECURITY: Added direct file access protection to plugin files. #3828 (@dparker1005)
- SECURITY: Improved request input handling and redirect safety throughout the plugin. #3829 (@dparker1005)
- SECURITY: The Authorize.net gateway now verifies TLS certificates when connecting to Authorize.net. #3916 (@dparker1005)
- SECURITY: The 2Checkout gateway now verifies TLS certificates when sending API requests. #3917 (@dparker1005)
- SECURITY: The `[pmpro_member]` shortcode is now also removed from newly added post meta saved by users who cannot edit users. #3921 (@dparker1005)
- SECURITY: The REST API order endpoint now only includes order notes for users with the `pmpro_orders` capability. #3918 (@dparker1005)
- SECURITY: Values in the members, orders, and logins report CSV exports that start with a spreadsheet formula character are now prefixed with a single quote so they are not run as formulas. #3922 (@dparker1005)
- SECURITY: The admin redirect for missing members, orders, subscriptions, discount codes, and levels now only runs for users who can access the Memberships menu. #3920 (@dparker1005)
- SECURITY: The Billing page now redirects to the Membership Account page when the requested subscription does not exist. #3919 (@dparker1005)
Added
- Merged the Subscription Delays Add On into core. The new First Recurring Payment setting on levels and custom pricing discount codes can delay the first recurring payment by a number of days or until a date set with a date pattern. #3630 (@dparker1005, @kimcoleman)
- Merged the Set Expiration Dates Add On into core. Levels and custom pricing discount codes can expire memberships on a date set with a date pattern. #3630 (@dparker1005, @kimcoleman)
- Added percentage and fixed amount discount code types alongside the existing per-level custom pricing. The discount is calculated from each level's current pricing and can apply to the initial payment, recurring payments, or both, while the billing cycle, trial, and expiration come from the level. #3727 (@dparker1005)
- Added a migration tool for deprecated gateways, opened from the "Migrate Subscriptions Off This Gateway" button on the gateway's Payment Settings page. It recreates active subscriptions at Stripe (or sets the memberships to expire), can email members, cancels the old gateway subscriptions, and supports a dry run. A final step deletes the gateway's stored API credentials and stops loading the gateway; orders and subscriptions are kept. #3700 (@dparker1005)
- Added WordPress Abilities API support (WordPress 6.9+) for querying membership levels, orders, subscriptions, and PMPro search results, and for viewing, changing, and cancelling a member's memberships. Abilities are available over the REST API and to MCP clients through an MCP adapter plugin. #3736, #3757 (@mircobabini, @dparker1005)
- Added a `wp pmpro` WP-CLI command set for memberships, members, levels, orders, and subscriptions, and the `pmpro_cli_init` action for Add Ons to register their own commands. #3740, #3757 (@flintfromthebasement, @dparker1005)
- Added `/pmpro/v1/memberships`, `/pmpro/v1/orders`, and `/pmpro/v1/subscriptions` REST API collection endpoints with filtering, sorting, and pagination. #3740, #3757 (@flintfromthebasement, @dparker1005)
- The Subscription Delays and Set Expiration Dates Add Ons are now automatically deactivated and can no longer be activated. Their saved settings are used as-is, their filters still run, and their helper functions remain as deprecated wrappers. Custom code that removed the Add Ons' own hook callbacks no longer has any effect. #3630 (@dparker1005)
- Added an "Awaiting Payment Method" filter and tag on the Subscriptions list, an admin notice, and a Membership Account page notice for subscriptions migrated to Stripe that have no payment method on file. The default Recurring Payment Reminder email now asks these members to add a payment method. #3700 (@dparker1005)
- Added the "Deprecated Gateway Stripe Migration" and "Deprecated Gateway Checkout Required" email templates, shown on sites that still use a deprecated gateway. #3700 (@dparker1005)
- The "Update Billing Info" links on the Membership Account and Billing pages no longer require the subscription to have an order. The Billing page link now only shows for subscriptions on the active gateway when that gateway supports payment method updates, matching the Membership Account page. #3700 (@dparker1005)
- Added the `pmpro_deprecated_gateway_batch_size` filter to set how many subscriptions the deprecated gateway migration processes per batch. #3700 (@dparker1005)
- Added a captcha to the login and lost password forms, including wp-login.php, when reCAPTCHA or Cloudflare Turnstile is enabled. The captcha is only shown after a failed login or other suspicious activity from the visitor's IP address in the last 15 minutes. #3765 (@dparker1005)
Compatibility
- Requires WordPress
- 5.2
- Tested up to
- 7.1
- Requires PHP
- 7.4
Verified safe
Paid Memberships Pro v3.9 scanned clean with no security threats detected.
View full scan report