Bug Fixes
Block public registration requests from merging into and taking over an existing member account
Stop the security setup notice from appearing for payment providers not included in your WishList Member edition (e.g., after downgrading from Classic/Pro)
Require a successful Stripe charge, not just 3D Secure verification, before granting membership access, and prevent that confirmation link from being reused for a different level or member
Prevent a manipulated Authorize.net payment notification from canceling a membership
Fix the AJAX login form’s Lost Password link so it actually sends the reset email
Other
Update the PayPal Commerce Platform notice link to point to the correct help article
Features
Keep accepting webhooks from payment integrations (Stripe, Recurly, Authorize.net, Plug&Paid, PayPal Express Checkout/Pro) that were already active before this update but haven’t finished webhook verification setup, with an admin reminder to finish setup — newly activated integrations still require verification before their webhooks are accepted
Bug Fixes
Restore API authentication for named keys (ThriveCart, Digistore24, SamCart), fixing a 3.33.0 regression that only accepted the master key
Require a confirmed click before unsubscribe/resubscribe links take effect, so email security scanners and link previews can no longer unsubscribe members automatically
Fix a white screen on every admin page caused by a corrupted license retry count on PHP 8
Prevent large page-builder pages (e.g. Bricks) from loading blank when PayPal Express Checkout is active
Fix Stripe Connect webhooks being rejected after connecting or refreshing credentials, which could leave canceled subscriptions active; the Refresh Stripe Credentials button is now available for all connected accounts
Hardened the random secret generator used by some payment integrations to improve secret strength
Features
Add PayPal Complete Payments (PPCP) as a new payment gateway
Jump to any WishList Member admin screen straight from the WordPress command palette
Add membership protection support for the Divi 5 builder
Show refund and coupon details on Stripe invoice views
Bug Fixes
Reactivate expired members when they are re-added through Zapier
Keap: honor your level cancellation settings when recovering subscription status, and restore recurring status for inactive orders
Restore the WishList Member protection box on LearnDash courses, lessons, and other LearnDash content
Stop protecting media attachments when file protection is unavailable on your server, so downloads and images are not broken
Honor cancel-at-end-of-subscription for PayPal after a sequential level upgrade
Keep membership level data current immediately after a change, preventing stale access
Prevent errors when processing 1ShoppingCart notifications that have no tags
Keep a team invitation in place until the member is successfully added
Security
Strengthen payment notification handling against forged and replayed requests
Tighten team account and API access controls
Harden file protection, login, and profile handling against tampering
Other
Update the built-in membership blocks (login, profile, profile photo, member levels, pay-per-post) to the latest WordPress block format for WordPress 7.0 compatibility
PHP 8.1 compatibility improvements
- Add webhook support alongside Silent Post to Authorize.net ARB. Silent post will be hidden for new installs.
- Prevent critical error when curl is not enabled and PayPal integration is enabled.
- Invalidate per-user txn-id cache on transaction updates
- CVE-2026-25445
- CVE-2026-25446
- CVE-2026-24575
Bug Fixes
Skip ob_start callback on PayPal Express Checkout during REST, AJAX, and cron requests
Fixed issue where the Shortcode inserter’s modal when adding/editing posts/pages stopped working
Prevent empty members list on strict database configurations
Fixed registration form and sequential upgrade PHP notices
Features
Updated Pay Per Post settings to include auto-creation of accounts
Bug Fixes
Remove deprecated IE conditional script loading
Fix incorrect registration date when importing members with registration date specified
Other
Update renewal link in Dashboard to point to my.wishlistmember.com
Disabled file consistency check in selfcheck
Bug Fixes
MailChimp subscribe/unsubscribe
MailChimp empty Interest Groups
Bug Fixes
Ensure only_show_content_for_level skips only main singular queries
eWAY credential test
Bug Fixes
* Edge case infinite loop when setting script translations on sites that may have symlinked folders that recurses onto itself (#2557) ([0270c9](https://github.com/caseproof/wishlist-member/commit/0270c9d76064bb8c3052f43cab3891e36556e1ff))
* Menu protection returning incorrect menu items if `wp_nav_menu_objects` filter is called multiple times due to incorrect caching (#2559) [#2558](https://github.com/caseproof/wishlist-member/issues/2558) ([f70569](https://github.com/caseproof/wishlist-member/commit/f705695da69a5fb4066444f469f61fa273f7ca7a))
* Respect per-page non-member redirects (#2548) ([93f8cc](https://github.com/caseproof/wishlist-member/commit/93f8cc3fbcd7f76e308daa55b3d0a4f805439537))
* Translation functions called to early (#2556) ([d4d3e5](https://github.com/caseproof/wishlist-member/commit/d4d3e5cc36c59306ab851d9284ded2429bb749f3))
* Use strict string comparisons in admin/ui selections (#2551) ([5bd7d2](https://github.com/caseproof/wishlist-member/commit/5bd7d2e4fe741f9193d88af425f50817a674fb9c))
### Features
##### internal
* Upgraded growth tools to ~1.5.0 ([a06881](https://github.com/caseproof/wishlist-member/commit/a06881dbc762ca897a3f48850eb97c03bd2aa3d7))
### Bug Fixes
* Add exec function check before wget fallback [#2471](https://github.com/caseproof/wishlist-member/issues/2471) ([09b569](https://github.com/caseproof/wishlist-member/commit/09b569233a5847d4f22bb0704c993eabb9f73c91))
* Avoid WP 6.8.3 placeholder mismatch in API2 (#2540) ([aa7e46](https://github.com/caseproof/wishlist-member/commit/aa7e4667951ad628a792e681c9e02921ba1dbeeb))
* Custom registration fields with spaces in names not properly displayed in WP User profile page [#2501](https://github.com/caseproof/wishlist-member/issues/2501) ([79ed6a](https://github.com/caseproof/wishlist-member/commit/79ed6a8db030115e9194e06dc761b24e732fcd34))
* Duplicate queries from Issue #2523 (#2525) [#2523](https://github.com/caseproof/wishlist-member/issues/2523) ([b5141f](https://github.com/caseproof/wishlist-member/commit/b5141f514ebb71338c6409ed1878bfe15307fa8e))
* Fetch legacy rollback download url via licenses api (#2538) ([2bde9e](https://github.com/caseproof/wishlist-member/commit/2bde9e1c4210dc9637dde678e33c95b81bac5f66))
* Fixed fatal error when trying to access/edit a member via admin. (#2532) [#2530](https://github.com/caseproof/wishlist-member/issues/2530) ([6700eb](https://github.com/caseproof/wishlist-member/commit/6700eb77251ee927953d8263673e6e1f95d6566d))
* Possible bug when sending an integer $level_id value to Get_UserLevelIndex() method ([14f3b2](https://github.com/caseproof/wishlist-member/commit/14f3b2a2585492df06d86077b6119802128138ba))
* Removed wishlistactivation.com in selfcheck as it's no longer active (#2524) [#2520](https://github.com/caseproof/wishlist-member/issues/2520) ([2a68a5](https://github.com/caseproof/wishlist-member/commit/2a68a503d39cb650b776bcff749ce8da39f36976))
* Stripe integration unable to load due to the number of payperposts (#2534) [#2531](https://github.com/caseproof/wishlist-member/issues/2531) ([2b87ce](https://github.com/caseproof/wishlist-member/commit/2b87ce9882c68b2a48a6cfd8062f9cfb03a7412f))
* Textarea custom field not showing in WP profile [#2494](https://github.com/caseproof/wishlist-member/issues/2494) ([8b428f](https://github.com/caseproof/wishlist-member/commit/8b428f3e59ed1e98c5cb8a2635585bc447acb6f9))
* Unable to open page builders when WLM is active (#2546) [#2537](https://github.com/caseproof/wishlist-member/issues/2537) ([0ec63b](https://github.com/caseproof/wishlist-member/commit/0ec63b930b730abea80722228c8ba3f68ba754b9))
* Undefined variable $valule ([30073b](https://github.com/caseproof/wishlist-member/commit/30073bf496779f4f343310959d74823f839a6dc1))
##### deprecated
* Replaced `wp_get_user_request_data()` with `wp_get_user_request()` ([0cfd30](https://github.com/caseproof/wishlist-member/commit/0cfd30c7d2ad1d8ca163efa21a51d86c91e55dd9))