Userpro – User Profiles With Social Login history.

Security release. Full detail in `changelog.txt`. - Security: Privilege escalation (CVSS 9.8, Patchstack 2026-10-06). A guest registration could overwrite the new account's `wp_capabilities` row by posting a field name containing a Unicode homoglyph in place of an ASCII letter. MySQL's accent-insensitive `meta_key` collation matched the homoglyph key to the real `wp_capabilities` row; the `remove_accents()` denylist did not cover all characters in that equivalence class. Fixed in two layers: (1) `functions/ajax.php` now applies `sanitize_key()` to every POST key when building `$form`, stripping non-ASCII bytes before they reach `update_user_meta()`; (2) `functions/user-functions.php` now rejects any meta key containing non-ASCII bytes and uses `sanitize_key()` for the capabilities/user_level check, as defense-in-depth for all callers. (`functions/ajax.php`, `functions/user-functions.php`)

Stability fix. Full detail in `changelog.txt`. - Stability: PHP warning "Attempt to read property 'post_name' on null" on archive pages, 404s, and any non-single-post context is now suppressed. `get_post()` returns null on these pages and the title filter was reading `$post->post_name` without a null guard. The warning appeared in the site header on any page where UserPro was active but no post was in context. (`functions/hooks-actions.php`)