Userpro – User Profiles With Social Login v5.1.16

Security release. Full detail in `changelog.txt`. - Security: Privilege escalation (CVSS 9.8, Patchstack 2026-10-06). A guest registration could overwrite the new account's `wp_capabilities` row by posting a field name containing a Unicode homoglyph in place of an ASCII letter. MySQL's accent-insensitive `meta_key` collation matched the homoglyph key to the real `wp_capabilities` row; the `remove_accents()` denylist did not cover all characters in that equivalence class. Fixed in two layers: (1) `functions/ajax.php` now applies `sanitize_key()` to every POST key when building `$form`, stripping non-ASCII bytes before they reach `update_user_meta()`; (2) `functions/user-functions.php` now rejects any meta key containing non-ASCII bytes and uses `sanitize_key()` for the capabilities/user_level check, as defense-in-depth for all callers. (`functions/ajax.php`, `functions/user-functions.php`)