Sync edit-team template: scope the nonce to the submitted team id

[MILAN88888]

All Submissions:

• Have you followed the User Registration Contributing guideline?
• Does your code follow the WordPress' coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

This is the sync half of a security fix. The real fix lives in the Pro repo: wpeverest/user-registration-pro#1526 (Team Membership IDOR, wpeverest/user-registration-pro#1497).

templates/myaccount/edit-team.php is byte-identical in this repo and in Pro, and it is kept in sync automatically. The Pro fix had to change that template, so the same changes have to land here too — otherwise the next sync would quietly revert them.

What changed in the template:

1. The security nonce is now tied to the specific team being edited — wp_nonce_field( 'ur_edit_team_' . $team_id, ... ) instead of one shared name for every team.
2. $team_id is now run through absint(). This matters: it used to default to an empty string, which would have produced a nonce name of ur_edit_team_ while the Pro handler expects ur_edit_team_0 — a silent mismatch.
3. The members_id and max_seats hidden inputs are removed. The Pro handler no longer reads either — the seat limit comes from urm_team_seats and the member IDs are resolved from the submitted emails — so leaving them in the form only invited someone to wire them back up.
4. The seat count moved to data-max-seats on the <form>. The frontend script read max_seats for its client-side cap, so the value still has to reach the page; as an attribute it is available to the script but is not submitted.
5. Template @version bumped 1.0.0 → 1.0.1, as required when an overridable template changes.

There is no behaviour change in this repo. The Team Membership feature is Pro-only, so nothing in this plugin reads this template today. This PR exists purely to keep the two copies identical.

How to test the changes in this Pull Request:

1. Confirm this template is still byte-identical to the Pro copy on wpeverest/user-registration-pro#1526.
2. Confirm the free plugin has no regressions — this template is not used by any feature in this repo.
3. The actual security testing steps are in wpeverest/user-registration-pro#1526.

Types of changes:

• Bug fix (non-breaking change which fixes an issue)
• Enhancement (modification of the currently available functionality)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Not breaking in this repo, since the template is unused here. It is a breaking change for Pro sites that override this template in their theme — see the note on wpeverest/user-registration-pro#1526.

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you successfully ran tests with your changes locally?
• Have you updated the documentation accordingly?

Verified the file is byte-identical to the Pro branch's copy (cmp reports no differences) and passes php -l. PHPCS shows no new violations, only removals — against the WordPress standard, 13 on develop and 10 here; everything remaining pre-dates this PR. (Measured with the WordPress standard rather than the project ruleset, which needs PHPCompatibility and WPEverest-Core installed; the earlier 14 → 13 figure in this PR's history came from the project ruleset, so the two counts are not comparable.)

Merge order: this should land together with, or just after, wpeverest/user-registration-pro#1526 — on its own it does nothing.

Changelog entry

Fix: Team Membership - scope the Edit Team form nonce to the team being edited and drop the unused seat-limit and member-ID inputs (template sync with Pro).

[tg-autopilot]

Build for 137e595c is ready 🛎️

⬇️ Download user-registration-5.2.7.zip (8.1M)

Installs directly via Plugins → Add New → Upload Plugin.
Link expires in 30 days · updated Sep 3, 2026 12:29 PM +0545

[y000yal]

@MILAN88888 Reviewed alongside the pro-side fix in wpeverest/user-registration-pro#1526 (closes wpeverest/user-registration-pro#1497). This change is correct and the blob matches the pro copy exactly (b7930cfc8..611e71471 on both sides), so the template stays in sync. absint() on $team_id is the right call given the value now feeds the nonce action.

One follow-up that belongs in this PR, because it only becomes true once the pro handler lands:

members_id (line 77) and max_seats (line 78) become dead inputs. The pro handler no longer reads either, deriving the roster from the submitted emails and the seat limit from urm_team_seats in the database. max_seats is the one to care about: leaving it in the form reads as if it still drives the seat limit, and re-wiring it would undo the seat-tampering fix. Both inputs should be dropped here and in the pro PR in the same pass, so the two copies do not diverge.

Everything else here matches the pro side. The @version bump and the release note for theme template overrides are both covered in the pro PR description.

[y000yal]

LGTM👍