diff --git a/CHANGELOG.txt b/CHANGELOG.txt index ff2c768ced..8ceea60486 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -1,4 +1,9 @@ == Changelog == += 2.4.3 - 2020-08-25 +* SECURITY: Fixed a cross-site scripting vulnerability in the code that updates the Required Membership settings on a post. This vulnerability could have been used in conjunction with other security vulnerabilities to trick an admin into editing the membership settings for a page, potentially exposing members only content to non-members. It is unlikely that there was any active exploitation of this vulnerability. This issue may also have shown up as a bug on some sites using page builders, where the membership settings for a post would be cleared out when editing a post. (Thanks to the wp.org plugin review team for catching this issue.) +* SECURITY: Better escaping of variables shown in the Require Membership meta box and related SQL queries. +* BUG FIX/ENHANCEMENT: Renamed the Vietnamese language files to match what is expected. + = 2.4.2 - 2020-08-24 * SECURITY: Updated the PMPro REST API endpoints accessed via the GET method to also require appropriate capabilities to access. The membership confirmation text will be hidden from non-members and non-admins. The endpoints to check a user's level or access to a post require the pmpro_edit_memberships capability now. You should make sure your API users have the appropriate capabilities to use the API. You can use the pmpro_rest_api_route_capabilities filter and/or pmpro_rest_api_permissions filter to change this behavior. * BUG FIX: Fixed issues with the PMPro REST API endpoints, including the discount code and checkout level endpoints. diff --git a/paid-memberships-pro.php b/paid-memberships-pro.php index 5aaf006fb5..2d84bb0986 100644 --- a/paid-memberships-pro.php +++ b/paid-memberships-pro.php @@ -3,7 +3,7 @@ * Plugin Name: Paid Memberships Pro * Plugin URI: https://www.paidmembershipspro.com * Description: The most complete member management and membership subscriptions plugin for WordPress. - * Version: 2.4.2 + * Version: 2.4.3 * Author: Stranger Studios * Author URI: https://www.strangerstudios.com * Text Domain: paid-memberships-pro @@ -16,7 +16,7 @@ */ // version constant -define( 'PMPRO_VERSION', '2.4.2' ); +define( 'PMPRO_VERSION', '2.4.3' ); define( 'PMPRO_USER_AGENT', 'Paid Memberships Pro v' . PMPRO_VERSION . '; ' . site_url() ); define( 'PMPRO_MIN_PHP_VERSION', '5.6' ); diff --git a/readme.txt b/readme.txt index 4b9ef85228..d7c4fa9018 100644 --- a/readme.txt +++ b/readme.txt @@ -3,7 +3,7 @@ Contributors: strangerstudios, kimannwall, andrewza, dlparker1005, paidmembershi Tags: memberships, members, subscriptions, ecommerce, user registration, member, membership, e-commerce, paypal, stripe, braintree, authorize.net, payflow, restrict access, restrict content, directory Requires at least: 4 Tested up to: 5.5 -Stable tag: 2.4.2 +Stable tag: 2.4.3 Get Paid with Paid Memberships Pro: The most complete member management and membership subscriptions plugin for your WordPress site. @@ -153,6 +153,11 @@ Not sure? You can find out by doing a bit a research. 8. Membership Account page, display all sections or show specific sections using shortcode attributes. == Changelog == += 2.4.3 - 2020-08-25 +* SECURITY: Fixed a cross-site scripting vulnerability in the code that updates the Required Membership settings on a post. This vulnerability could have been used in conjunction with other security vulnerabilities to trick an admin into editing the membership settings for a page, potentially exposing members only content to non-members. It is unlikely that there was any active exploitation of this vulnerability. This issue may also have shown up as a bug on some sites using page builders, where the membership settings for a post would be cleared out when editing a post. (Thanks to the wp.org plugin review team for catching this issue.) +* SECURITY: Better escaping of variables shown in the Require Membership meta box and related SQL queries. +* BUG FIX/ENHANCEMENT: Renamed the Vietnamese language files to match what is expected. + = 2.4.2 - 2020-08-24 * SECURITY: Updated the PMPro REST API endpoints accessed via the GET method to also require appropriate capabilities to access. The membership confirmation text will be hidden from non-members and non-admins. The endpoints to check a user's level or access to a post require the pmpro_edit_memberships capability now. You should make sure your API users have the appropriate capabilities to use the API. You can use the pmpro_rest_api_route_capabilities filter and/or pmpro_rest_api_permissions filter to change this behavior. * BUG FIX: Fixed issues with the PMPro REST API endpoints, including the discount code and checkout level endpoints.