Merge branch 'master' into develop

Author: y000yal

.github/sync-file-list.yml

@@ -1,4 +1,4 @@
-wpeverest/user-registration-pro@develop:
+themegrill/user-registration-pro@develop:
     - source: assets
       exclude: |
         js/divi-vb-modules.js

.github/workflows/draft-release.yml

@@ -127,7 +127,7 @@ jobs:
 
       - name: Build
         id: build
-        uses: wpeverest/action-build@4.0.2
+        uses: themegrill/action-build@4.0.3
         with:
           generate-zip: true
 

.github/workflows/pr-build-zip.yml

@@ -25,7 +25,7 @@ jobs:
       public-base-url: https://themegrill-pr-artifacts.s3.amazonaws.com
       s3-region: us-east-1
     # Cross-org call: this repo actually lives in themegrill (transferred
-    # from wpeverest), and the reusable workflow lives in wpeverest/.github --
+    # from wpeverest), and the reusable workflow lives in themegrill/.github --
     # `secrets: inherit` cannot reach across that boundary reliably (same
     # issue confirmed on user-registration-pro: worked briefly right after
     # the transfer, then started failing with "Secret BOT_TOKEN is required,

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
 
       - name: Build
         id: build
-        uses: wpeverest/action-build@4.0.2
+        uses: themegrill/action-build@4.0.3
 
       - name: Delete existing SVN tag if exists
         env:

.github/workflows/staging-test.yml

@@ -127,7 +127,7 @@ jobs:
           mkdir python-code
           cd python-code
           git init
-          git remote add origin git@github.com:wpeverest/UR-Automation.git
+          git remote add origin git@github.com:themegrill/UR-Automation.git
           git pull origin test-ur-free
           pip install -r requirements.txt
           chmod +x test_ur_free.sh

CHANGELOG.txt

@@ -1,3 +1,17 @@
+= 5.2.8    - 09/09/2026 =
+* Fix      - Content restriction bypassed via WordPress core REST API. Thanks Patchstack.
+* Fix      - Standardized outbound UTM parameters and invalid campaign keys.
+* Fix      - Users could be redirected to an outside website after logging in.
+* Fix      - Membership thank you page exposed another member's account details. Thanks Karthik Ramakrishnan.
+* Fix      - Team Membership: scoped Edit Team form nonce to the team being edited.
+* Fix      - Use timing-safe comparison for email confirmation and approval tokens.
+* Fix      - Stripe payment could be replayed to renew a membership without paying. Thanks Patchstack.
+* Fix      - Privilege escalation via membership role and open redirect after login. Thanks Baikuya and Sai Praneeth Koti.
+* Add      - `{{force_logout_url}}` smart tag for Pro's prevent concurrent login email.
+* Fix      - Expired membership could be renewed by replaying an earlier Stripe payment. Thanks MYUNGYONG LEE.
+* Fix      - Deactivate License button did nothing when pro-activation transient was set.
+* Fix      - Registration forms not validating publish status or restricting assigned roles. Thanks Ananda Dhakal.
+
 = 5.2.7    - 11/08/2026 =
 * Fix      - Payment related issues for tax & others
 * Fix      - User login after invalid failed payment.