[04-August-2026] Membership Pro version 4.7.0 released

Dear customers !

I’m happy to announce the release of Membership Pro version 4.7.0! This release contains improvements as listed below:

1. Added Membership Pro - GeoIP Plugin
The plugin will auto detect country of users base on their IP address and have that detected country selected automatically on subscription form, save subscribers from having to choose the country from long list of countries in countries dropdown

2. Improve Offline Payment Reminder Emails
Attach PDF invoice of the subscription to offline payment reminder emails and have it delivered to subscribers to remind them to complete payment for their offline payment subscriptions.

3. Added missing CSRF tokens check
There were some methods/operations missing CSRF token check. These missing checks are added in this release to prevent CSRF attacks.

4. Other technical changes
- We worked on several code refactoring on this release, move the business logic from controllers to models to follow MVC best practices, easier to maintain and extend code in the future.
- Updated code of the client validation engine which we are using to use POST requests for ajax validation instead of GET.
- Clean up/delete invoices, member cards... automatically after usage to both save hosting space and also prevent unauthenticated access on servers does not support .htaccess
- Bug Fixed: Allow using comma character in value of Radio options.

Please update your site to latest version 4.7.0 of Membership Pro to uses these improvements. Thanks for continue using our extensions and support our development

Regards,

Tuan

Hi Tuan,
I installed the update, and mySites.guru started flagging a vulnerable extension. It thought the GeoIP plugin from Regular Labs was the problem, but that has never been installed. On the off-chance that you used the same library, I installed the latest (fixed) Regular Labs plugin - no change. Then I uninstalled that and your new GeoIP plugin, and the problem flag disappeared.
So either mySites.guru is in error, or your GeoIP plugin has the same vulnerabilities as the Regular Labs one of the same name had.

Hi Clive

I do not know how mySites.guru handle it internal, so I do not know. The GeoIP plugin does not use any library, it just call the service from ip-api.com/ to detect country of the visitor, so maybe it is just a false assumption from mySites.guru. Could you please report that to Phil ?

Regards,

Tuan

I have just done that. Hopefully it is just because the two plugins have the same name.
As I have uninstalled your new GeoIP plugin, will that cause any problems with the subscription form?

Thanks Clive. No, it won't affect anything. In case it is disabled, the Default country from configuration will be used as Default country for country field on subscription form.

That plugin is not enabled by default, so I guess it is just because it uses the same name GeoIP with other vulnerability extension

Please update us with the result once you heard back from him

Regards,

Tuan

Hi Tuan,
I have had the following reply from Phil:-
"Thanks for getting in touch, and for the detective work, that saved me a lot of digging.
It's the first of your two theories: mySites.guru was confusing the two plugins. My bug, not JoomDonation's.
The Regular Labs plugin installs as system/geoip and the new Membership Pro one installs as osmembership/geoip. Joomla identifies a plugin by its folder and its element together, and my detection rule was only checking the element, so anything calling itself geoip matched no matter who wrote it. Yours was not the only site caught by it.
So the JoomDonation GeoIP plugin does not carry the Regular Labs vulnerability. Reinstall it whenever you like, and you can tell Tuan there is nothing for him to fix at his end.
I disabled the rule on production this morning, so the flag clears on your next scan. I am adding proper folder matching to the detection code today, so the rule can come back pointed only at the Regular Labs plugin.
If you want to know what the actual Regular Labs issue was, I wrote it up here: mysites.guru/blog/regular-labs-joomla-ex...on-security-release/
Sorry for the scare.
Kindest regards
Phil"

Great. Happy to hear that. And thanks Clive for the update

Regards,

Tuan