Final version bump to v5.2.2 for public release.

Squashed commit of the following:

commit 6a98399
Author: Prajjwal Poudel <85762481+iamprazol@users.noreply.github.com>
Date:   Fri Jun 19 09:22:11 2026 +0545

    Fix/vulnerability v5.2.1 (#1300)

    * UR-4561 Fix - Subscriber-Level IDOR and Payment Bypass on Membership Upgrade Action

    * Fix - Unauthenticated Privilege Escalation via Off-Form Membership Tier Substitution in Registration

    * Fix - Webhook not configured but still can bypass paypal payments

    * Fix - Delete intercepeted attacker registered as user

    * Fix - Issue

    * Sync codes to pro

    * UR-4584 Fix - PayPal Upgrade Membership – Incorrect Redirect & Incomplete Upgrade Action

commit 5b11d71
Author: Prajjwal Poudel <iamprazol@gmail.com>
Date:   Fri Jun 19 09:20:20 2026 +0545

    UR-4586 Fix - Hardcoded database table names causing failures on custom table prefixes

commit e810837
Author: Prajjwal Poudel <85762481+iamprazol@users.noreply.github.com>
Date:   Fri Jun 19 09:09:10 2026 +0545

    Fix - Password reset link shows invalid or expired error after update from 5.1.6 (#1299)

commit 9d0462d
Author: saurav <133834846+saurab018@users.noreply.github.com>
Date:   Thu Jun 18 15:44:11 2026 +0545

    UR-4576: Fix membership subscriptions stuck pending on 3D Secure cards (#1303)

    Stripe SDK (Basil API) dropped invoice.payment_intent in favour of
    invoice.payments; the front-end still read payment_intent and crashed,
    so the 3DS challenge never ran and orders/subscriptions stayed pending.
    Resolve the PaymentIntent server-side and expose it for SCA; guard the
    client handler and confirm 3D Secure.

commit 7bb1e64
Author: saurav <133834846+saurab018@users.noreply.github.com>
Date:   Thu Jun 18 15:39:29 2026 +0545

    UR-4547 Fix - Checkbox visibility issue caused by CSS conflict from User Registration & Membership plugin (admin.css) (#1295)

    The plugin's admin.css applies  to checkboxes/radios
    on the WP user profile page with higher specificity than WP core's
    . WP draws
    the checkmark as a white SVG via , so a checked box
    shows a white checkmark on a white background — appearing empty.

    Adds a scoped, additive  rule that restores the theme-color
    background only on the WP profile/user-edit pages so the white check
    becomes visible. No existing rules are modified.

commit 031878e
Author: saurav <133834846+saurab018@users.noreply.github.com>
Date:   Thu Jun 18 15:38:14 2026 +0545

    UR-4550 Fix - Password reset link shows invalid or expired on hosts that strip the reset cookie (#1296)

    * UR-4550 Fix - Password reset link shows invalid or expired on hosts that strip the reset cookie

    The reset flow is a two-step cookie handoff: redirect_reset_password_link()
    sets the wp-resetpass-* cookie then 302s to the form, which reads the cookie
    back to validate the key. Managed hosts/CDNs (e.g. Flywheel behind Fastly)
    strip the non-allowlisted Set-Cookie at the edge, so the form never sees the
    cookie and every user gets 'invalid or expired' regardless of key validity.

    Add a cookie-independent fallback: stash login:key in a short-lived transient
    keyed by an opaque token carried through the redirect, and repopulate
    from it at step 2 only when the cookie is missing. Existing code runs unchanged
    and the cookie stays the primary path (no-op on hosts that deliver it). Token
    is a 32-char CSPRNG value, single-use (deleted on reset), 1h TTL, alnum-validated,
    with Referrer-Policy: no-referrer so it cannot leak via the Referer header.

    * comment managed

commit 1b24a0e
Author: saurav <133834846+saurab018@users.noreply.github.com>
Date:   Thu Jun 18 15:34:39 2026 +0545

    UR-4326 Dev - Add UR_WPML compatibility service class for centralized WPML handling (#1301)

commit 7a618af
Author: saurav <133834846+saurab018@users.noreply.github.com>
Date:   Thu Jun 18 14:37:00 2026 +0545

    Fix: PayPal production credentials not detected due to option key mismatch (#1302)

    Credentials are saved under  option keys but were looked up using the raw mode value , causing  errors when production mode was active. Added  helper that maps  →  for option key lookups while leaving the mode value unchanged for API URL and flow comparisons.

    Fixes UR-4565.

commit 1787bee
Author: Prajjwal Poudel <iamprazol@gmail.com>
Date:   Wed Jun 10 09:10:10 2026 +0545

    UR-4556 Fix - Payment Method Bypass Allows Free Access to Paid Memberships via Tampered Registration Request

commit dc79fbf
Author: Prajjwal Poudel <iamprazol@gmail.com>
Date:   Tue Jun 9 15:57:21 2026 +0545

    UR-4555 Fix - Missing Paypal Webhook Signature Verification.

Author: iamprazol

CHANGELOG.txt

@@ -1,3 +1,17 @@
+= 5.2.2    - 19/06/2026 =
+* Dev      - Add UR_WPML compatibility service class.
+* Fix      - Password reset link shows "invalid or expired" error.
+* Fix      - Membership subscriptions stuck pending on 3D Secure (SCA) cards.
+* Fix      - Hardcoded database table names causing failures on custom table prefixes.
+* Fix      - Checkbox visibility issue on WP user profile/edit page  caused by CSS conflict.
+* Fix      - PayPal credentials not detected during registration despite valid saved settings.
+* Fix      - Password reset link shows invalid or expired on hosts that do not support PHP cookies.
+* Fix      - Webhook not configured but still can bypass PayPal payments.
+* Fix      - Payment Method Bypass Allows Free Access to Paid Memberships via Tampered Registration Request.
+* Fix      - Payment method field during registration could be manipulated to bypass payment for paid memberships.
+* Fix      - Authenticated users could modify other members' subscriptions by supplying an arbitrary subscription ID during upgrade.
+* Fix      - Membership tier submitted during registration was not validated against the memberships configured on the form, allowing substitution with an off-form tier.
+
 = 5.2.1    - 28/05/2026 =
 * Fix      - Stripe order validation issue.
 * Fix      - Membership upgrade action not available after disabling group add-on.

assets/css/admin-rtl.css

@@ -8703,6 +8703,24 @@ body.user-registration-page {
 	}
 }
 
+// Additive bugfix: the checkbox/radio rule above sets background:#fff with higher specificity than WP core's
+// input:checked{background:theme-color}, so a checked box stays white and WP's white checkmark SVG is invisible.
+// Restore the theme-color background on :checked only (scope = WP profile/user-edit pages) so the check shows.
+body.user-registration-page {
+	#profile-page {
+		#your-profile {
+			table.form-table,
+			#application-passwords-section {
+				input[type="checkbox"]:checked,
+				input[type="radio"]:checked {
+					background: var(--wp-admin-theme-color, #2271b1);
+					border-color: var(--wp-admin-theme-color, #2271b1);
+				}
+			}
+		}
+	}
+}
+
 .ur-sticky-wrapper {
 	top: 0;
 	background: $white;

assets/css/admin.css

@@ -2518,59 +2518,85 @@
 			ur_membership_frontend_utils.show_payment_processing_overlay();
 
 			return new Promise(function (resolve, reject) {
+				var subscription = data.subscription || {};
+				var resolvePayload = {
+					subscription: subscription,
+					response_data: data.response_data,
+					message: data.message,
+					prepare_members_data: data.prepare_members_data,
+					form_response: data.form_response
+				};
+
 				if (
-					data.subscription &&
-					(data.subscription.status === "active" ||
-						data.subscription.status === "trialing")
+					subscription.status === "active" ||
+					subscription.status === "trialing"
 				) {
-					resolve({
-						subscription: data.subscription,
-						response_data: data.response_data,
-						message: data.message,
-						prepare_members_data: data.prepare_members_data,
-						form_response: data.form_response
-					});
 					ur_membership_frontend_utils.hide_payment_processing_overlay();
+					resolve(resolvePayload);
+					return;
 				}
 
-				var paymentIntent =
-					data.subscription.latest_invoice.payment_intent;
-
-				if ("trialing" !== data.subscription.status) {
-					if ("requires_action" === paymentIntent.status) {
-						data.paymentElements.stripe
-							.confirmCardPayment(paymentIntent.client_secret, {
-								payment_method: data.paymentMethodId
-							})
-							.then(function (result) {
-								if (result.error) {
-									var message = result.error.message;
-									reject(message, data);
-									return;
-								}
+				// Only an expanded PaymentIntent with a client_secret allows SCA / 3D Secure on the client.
+				var latestInvoice = subscription.latest_invoice || {};
+				var paymentIntent = latestInvoice.payment_intent;
+				var clientSecret =
+					paymentIntent && typeof paymentIntent === "object"
+						? paymentIntent.client_secret
+						: null;
+				var piStatus =
+					paymentIntent && typeof paymentIntent === "object"
+						? paymentIntent.status
+						: null;
+				var needsAction =
+					piStatus === "requires_action" ||
+					piStatus === "requires_source_action" ||
+					piStatus === "requires_confirmation";
+
+				if (clientSecret && needsAction) {
+					data.paymentElements.stripe
+						.confirmCardPayment(clientSecret)
+						.then(function (result) {
+							ur_membership_frontend_utils.hide_payment_processing_overlay();
+							if (result.error) {
+								reject(result.error.message, data);
+								return;
+							}
 
-								if (
-									"succeeded" === result.paymentIntent.status
-								) {
-									data.subscription.status = "active";
-									resolve({
-										subscription: data.subscription,
-										form_id: data.form_response.form_id,
-										response_data: data.response_data,
-										prepare_members_data:
-											data.prepare_members_data,
-										form_response: data.form_response,
-										three_d_secure: true
-									});
-								} else {
-									var message =
-										"Unable to complete the payment.";
-									reject(message, data);
-								}
-								ur_membership_frontend_utils.hide_payment_processing_overlay();
-							});
-					}
+							if (
+								result.paymentIntent &&
+								"succeeded" === result.paymentIntent.status
+							) {
+								subscription.status = "active";
+								resolve({
+									subscription: subscription,
+									form_id: data.form_response.form_id,
+									response_data: data.response_data,
+									prepare_members_data:
+										data.prepare_members_data,
+									form_response: data.form_response,
+									three_d_secure: true
+								});
+							} else {
+								reject(
+									"Unable to complete the payment.",
+									data
+								);
+							}
+						})
+						.catch(function (error) {
+							ur_membership_frontend_utils.hide_payment_processing_overlay();
+							reject(
+								error && error.message
+									? error.message
+									: "Unable to complete the payment.",
+								data
+							);
+						});
+					return;
 				}
+
+				ur_membership_frontend_utils.hide_payment_processing_overlay();
+				resolve(resolvePayload);
 			});
 		},
 

assets/css/admin.scss

@@ -42,6 +42,9 @@ public static function init() {
 	 */
 	public static function redirect_reset_password_link() {
 		global $wp;
+
+		self::maybe_restore_reset_password_cookie();
+
 		if ( isset( $wp->query_vars['ur-lost-password'] ) && empty( $wp->query_vars['ur-lost-password'] ) ) {
 			return;
 		}
@@ -53,12 +56,68 @@ public static function redirect_reset_password_link() {
 
 		if ( ( $is_ur_lost_password_page || $is_ur_login_or_account_page ) && ! empty( $_GET['key'] ) && ! empty( $_GET['login'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification
 			$value = sprintf( '%s:%s', sanitize_text_field( wp_unslash( $_GET['login'] ) ), sanitize_text_field( wp_unslash( $_GET['key'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification
+
+			if ( ! headers_sent() ) {
+				nocache_headers();
+			}
+
 			UR_Shortcode_My_Account::set_reset_password_cookie( $value );
 
-			wp_safe_redirect( add_query_arg( 'show-reset-form', 'true', ur_resetpassword_url() ) );
+			$redirect_url = add_query_arg( 'show-reset-form', 'true', ur_resetpassword_url() );
+
+			$token = wp_generate_password( 32, false );
+			set_transient( 'ur_rp_' . $token, $value, HOUR_IN_SECONDS );
+			$redirect_url = add_query_arg( 'urt', $token, $redirect_url );
+
+			wp_safe_redirect( $redirect_url );
 			exit;
 		}
 	}
+
+	/**
+	 * Restore the reset-password cookie from a transient when a CDN strips it at the edge.
+	 */
+	private static function maybe_restore_reset_password_cookie() {
+		$token = self::get_reset_password_handoff_token();
+
+		if ( '' === $token ) {
+			return;
+		}
+
+		// The opaque token lands in the URL, so keep it out of the Referer header.
+		if ( ! headers_sent() ) {
+			header( 'Referrer-Policy: no-referrer' );
+		}
+
+		$rp_cookie = 'wp-resetpass-' . COOKIEHASH;
+
+		if ( ! empty( $_COOKIE[ $rp_cookie ] ) ) {
+			return;
+		}
+
+		$value = get_transient( 'ur_rp_' . $token );
+
+		if ( false !== $value ) {
+			$_COOKIE[ $rp_cookie ] = $value;
+
+			set_transient( 'ur_rp_' . $token, $value, HOUR_IN_SECONDS );
+		}
+	}
+
+	/**
+	 * @return string Validated [A-Za-z0-9] token from the current request, or ''.
+	 */
+	private static function get_reset_password_handoff_token() {
+		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only lookup; key is validated by check_password_reset_key().
+		if ( empty( $_GET['show-reset-form'] ) || empty( $_GET['urt'] ) ) {
+			return '';
+		}
+
+		$token = sanitize_text_field( wp_unslash( $_GET['urt'] ) );
+		// phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+		return ctype_alnum( $token ) ? $token : '';
+	}
 	/**
 	 * Save and update a profie fields if the form was submitted through the user account page.
 	 *
@@ -789,6 +848,12 @@ public static function process_reset_password() {
 				 */
 				do_action( 'user_registration_reset_password', $user );
 
+				// Single-use: drop the CDN-proof transient handoff token now the reset succeeded.
+				$handoff_token = self::get_reset_password_handoff_token();
+				if ( '' !== $handoff_token ) {
+					delete_transient( 'ur_rp_' . $handoff_token );
+				}
+
 				$ur_account_page_exists   = ur_get_page_id( 'myaccount' ) > 0;
 				$ur_login_or_account_page = ur_get_page_permalink( 'myaccount' );