• SECURITY: Fixed a REST API authorization bypass where route capability checks were case-sensitive while WordPress routes are not. #3823 (@andrewlimaza, @kta1kri)
• SECURITY: PayPal Express, Website Payments Pro, Payflow Pro, and PayPal Standard API requests now verify PayPal's SSL certificate. #3830 (@dparker1005, @kta1kri)
• SECURITY: PayPal gateway error messages for invalid API responses no longer include the API request, which contained the merchant's API credentials. #3830 (@dparker1005, @kta1kri)
• SECURITY: Add On downloads from the license server no longer skip SSL verification and are now always requested over HTTPS. #3831 (@dparker1005, @kta1kri)
• SECURITY: Fixed an issue where the Orders admin search could be used to modify the database query. #3825 (@dparker1005)
• SECURITY: Added nonce checks to the license key form, usage tracking opt-in links, Stripe Connect fee acknowledgement, and several admin notice links. #3826 (@dparker1005)
• SECURITY: Added a missing capability check to the Setup Wizard save handler so it only runs for users with the pmpro_wizard capability. #3784 (@faisalahammad)
• ENHANCEMENT: Added a Stripe connection test to the payment settings page that checks daily and on demand whether Stripe and the Paid Memberships Pro Connect server can be reached and whether Stripe accepts the saved keys, with an admin notice when a key is rejected. #3792 (@dparker1005)
• ENHANCEMENT: Added additional PHP file extensions to the default extension blocklist for the getfile script. #3798 (@dparker1005, @kta1kri)
• BUG FIX: Connecting to Stripe now refuses to overwrite an existing connection with a different Stripe account. #3792 (@dparker1005)
• BUG FIX: The Stripe webhook notice no longer reports a missing webhook when Stripe is actually rejecting the saved credentials. #3792 (@dparker1005)
• BUG FIX: Refunding an order whose charge was already refunded in the Stripe dashboard now marks the order as refunded instead of failing. #3811 (@dparker1005)
• BUG FIX: Fixed Stripe webhook errors for charge.failed and charge.refunded events when another plugin loads an older version of the Stripe library. #3796 (@faisalahammad)
• BUG FIX: Guest comments no longer show the post author's PMPro avatar. #3822 (@flintfromthebasement)
• BUG FIX: Membership managers can now print order invoices. #3807 (@faisalahammad)
• BUG FIX: The Pay by Check gateway description now reflects that orders are marked as paid at checkout, and links to the Pay by Check Add On for manual payment approval. #3802 (@faisalahammad)
• BUG FIX: Fixed quotes in email template variable descriptions showing as HTML entities in the editor autocomplete. #3818 (@dparker1005)
• BUG FIX: The required asterisk is now shown only once on radio user fields. #3795 (@faisalahammad)
• BUG FIX: Fixed the styling of the Export to CSV button on admin list pages when it is rendered as a button. #3824 (@kimcoleman)
• BUG FIX: Expanded rows in the Orders, Members, Subscriptions, and Discount Codes list tables now take the full table width on mobile. #3816 (@faisalahammad, @kimcoleman)
• BUG FIX: The PMPro admin banner no longer overlaps the Screen Options and Help tabs on small screens, and list table row actions are tidied on mobile. #3815 (@kimcoleman)
• REFACTOR: Members List username row actions now use the same markup as the other PMPro list tables. #3817 (@kimcoleman)
• DEPRECATED: Deprecated PMPro_AddOns::http_request_args_for_addons(), which no longer changes request arguments. #3831 (@dparker1005)