UserPro - User Profiles with Social Login

Versión 5.1.16 — 5 octubre 2026

• Seguridad Security fix: Privilege escalation (CVSS 9.8, unauthenticated). A guest registration could overwrite the new account's wp_capabilities row by posting a field name containing a Unicode homoglyph in place of an ASCII letter (e.g. U+0209 replacing 'i' in wp_capabilities). MySQL's accent-insensitive meta_key collation matched the mutated key to the real wp_capabilities row, and the previous remove_accents() denylist did not cover all characters in that equivalence class.
• Mejorado Fixed in two layers: (1) functions/ajax.php now applies sanitize_key() to every POST key when building the form array, stripping all non-ASCII bytes before they reach update_user_meta(). (2) functions/user-functions.php now rejects any meta key containing non-ASCII bytes outright and uses sanitize_key() rather than remove_accents() for the capabilities/user_level denylist, as defense-in-depth for any caller that does not go through ajax.php.

Versiones anteriores

• 5.1.15 (1 octubre 2026): 1 mejorado
• 5.1.14 (11 septiembre 2026): 5 mejorado, 4 corregido, 8 seguridad, 1 eliminado
• 5.1.13 (13 agosto 2026): 5 mejorado, 1 eliminado