1.3 - 2026-09-23

• REFACTOR: Refactored pmproup_ prefix to pmpro_unlock_ to avoid conflicts with other plugins. Previous functions still work but throw deprecated warning. #22 (@andrewlimaza)
• SECURITY: The state nonce returned by Unlock Protocol is now verified everywhere an auth code is consumed (profile, checkout, admin member edit), not only at login. Prevents a logged-in member being re-linked to another wallet via a crafted link. #21 (@andrewlimaza)
• SECURITY: Wallet login now bails when no auth code or wallet is present. Previously an empty wallet lookup could match any user with a linked wallet. #21 (@andrewlimaza)
• SECURITY: Removing a wallet from a profile now acts on the user being saved and requires permission to edit that user. #21 (@andrewlimaza)
• SECURITY: Lock access checks now fail closed on RPC errors or empty responses, and require a well-formed wallet address. #21 (@andrewlimaza)
• ENHANCEMENT: Added better support when NFT's expire or transfer out of their wallet to another person. #22 (@andrewlimaza)
• BUG FIX: No longer stores an empty wallet address in user meta when a code exchange fails. #21 (@andrewlimaza)