UserPro v5.1.14 (+Addons) – Community and User Profile WordPress Plugin

– Performance fix: member directory custom-field sort now sorts and paginates
in the database query (meta_key + orderby=meta_value). Previously every
matching user was fetched, sorted in PHP, then sliced, and the pagination
total was miscalculated (page links ran to hundreds of empty pages).
– Stability fix: member directory now survives malformed page/search input.
?userp=abc, ?userp[]=1 and ?searchuser[]=x previously caused a PHP 8 fatal
(500); ?userp=-1 produced a negative SQL LIMIT. Page numbers are now cast
with absint() and a non-string search is ignored. Same absint() guard
applied to the Enhanced Member Directory / collage emd-page parameter.
– Performance fix: Enhanced Member Directory and collage now count matches with
a single COUNT query instead of fetching every matching user to count() them
(same fix already applied to the core member directory).
– Performance fix: userpro_badges_admin_users() is now capped at 500 rows via
the userpro_badges_admin_users_limit filter (previously fetched every
account on the site). Full user objects are kept so the badge user
dropdowns still show email addresses and load in a handful of queries.
– Removed dead get_pending_verify_requests_count() function from admin/admin.php
(zero callers; duplicate of the patched function in the requests addon).
– Security fix: SQL injection in the front-end post publish flow. The lookup
query in the ‘publish’ AJAX action concatenated post_content (which passes
through wp_kses without escaping quotes) into raw SQL; now uses
$wpdb->prepare(). Reachable by any logged-in user.
– Security fix: privilege/trust meta can no longer be set through a self-service
profile save. A denylist (filter: userpro_protected_profile_meta) blocks
userpro_verified, account status, connection lists, secret key, badge and
social-id meta from the profile-edit POST for non-admins. Previously any
logged-in user could set userpro_verified=1 on their own account.
– Security fix: the role-change guard in userpro_update_user_profile() used
is_admin(), which is always true during admin-ajax, so it never fired. Role
changes via profile save now require the promote_users capability.
– Security fix: userpro_crop_picupload AJAX action now requires a valid nonce
(previously none) and escapes the file link it returns (reflected XSS via the
src parameter).
– Security fix: SQL injection in the badges comment-count query
(count_user_comments) now uses $wpdb->prepare() with an integer cast.
– Security fix: social follow/unfollow AJAX now requires login and always uses
the current user as the follower (previously the follower id was taken from
the request, letting anyone forge follow relationships between any users).
– Hardening: user_id in the display-badges and post-sort AJAX actions is cast
with absint().
– Security fix: userpro_reset_option and userpro_user_invite AJAX actions now
require the manage_options capability. Both were registered for logged-out
users and gated by the public nonce only, so any visitor could reset all
plugin settings or send invitation emails to arbitrary addresses.
– Security fix: the protected-profile-meta check is now case-insensitive, so
variants like Userpro_Verified can no longer slip a value into the real
(case-insensitively matched) meta row.
– Fix: the profile picture/file crop AJAX now receives the security nonce from
the front-end script, so uploads keep working with the new nonce check.
– Fix: the legacy userpro_sc_follow / userpro_sc_unfollow AJAX actions called a
non-existent method and fataled on every request; they now use the same
follow API as the current handler (and still force the follower to the
logged-in user).
– Fix: UserPro admin screen now shows the correct version number (was stuck
at 5.1.11).
– Fix: restored bundled cacert.pem files (Campaign Monitor, Twitter libs) and
corrected the package folder name to “userpro” so uploads replace the
existing plugin instead of installing a second copy.