maximinime

At the time I wrote that fix, that string literal of SQL was wrapped in prepare(). Unwrapping it solved the issue for me. There are two, separate lines that need alteration (the “and” is not part of the query). I am no longer using the plugin.

I had the same issue so I corrected the relevant function in functions.load.php:

function wppb_show_admin_bar($content){
	global $current_user;

	$admintSettingsPresent = get_option('wppb_display_admin_settings','not_found');

	if ($admintSettingsPresent != 'not_found' && $current_user->ID)
		foreach ($current_user->roles as $role_key) {
			if (empty($GLOBALS['wp_roles']->roles[$role_key]))
				continue;
			$role = $GLOBALS['wp_roles']->roles[$role_key];
			if (isset($admintSettingsPresent[$role['name']])) {
				if ($admintSettingsPresent[$role['name']] == 'show')
					return true;
				if ($admintSettingsPresent[$role['name']] == 'hide')
					return false;
			}
		}
	return $content;//unmodified
}

I also modified the settings page so you don’t have to deactivate+reactivate after adding/editing additional roles:

<?php
function wppb_display_admin_settings(){
?>
	<form method="post" action="options.php#show-hide-admin-bar">
		<input type="hidden" name="wppb_display_admin_settings[dummy]" value="ensure array" />
	<?php
		global $wp_roles;

		$wppb_showAdminBar = get_option('wppb_display_admin_settings');
		settings_fields('wppb_display_admin_settings');
	?>

	<h2><?php _e('Show/Hide the Admin Bar on Front End', 'profilebuilder');?></h2>
	<h3><?php _e('Show/Hide the Admin Bar on Front End', 'profilebuilder');?></h3>
	<table class="wp-list-table widefat fixed pages" cellspacing="0">
		<thead>
			<tr>
				<th id="manage-column" scope="col"><?php _e('User-group', 'profilebuilder');?></th>
				<th id="manage-column" scope="col"><?php _e('Visibility', 'profilebuilder');?></th>
			</tr>
		</thead>
			<tbody>
				<?php
				foreach ($wp_roles->roles as $role) {
					$key = $role['name'];
					$setting_exists = !empty($wppb_showAdminBar[$key]);
					echo'<tr>
							<td id="manage-columnCell">'.$key.'</td>
							<td id="manage-columnCell">
								<input type="radio" name="wppb_display_admin_settings['.$key.']" value="default" ';if (!$setting_exists || $wppb_showAdminBar[$key] == 'default') echo ' checked';echo'/><font size="1">'; _e('Default', 'profilebuilder'); echo'</font><span style="padding-left:20px"></span>
								<input type="radio" name="wppb_display_admin_settings['.$key.']" value="show"';if ($setting_exists && $wppb_showAdminBar[$key] == 'show') echo ' checked';echo'/><font size="1">'; _e('Show', 'profilebuilder'); echo'</font><span style="padding-left:20px"></span>
								<input type="radio" name="wppb_display_admin_settings['.$key.']" value="hide"';if ($setting_exists && $wppb_showAdminBar[$key] == 'hide') echo ' checked';echo'/><font size="1">'; _e('Hide', 'profilebuilder'); echo'</font>
							</td>
						</tr>';
				}
				?>

	</table>

	<div align="right">
		<input type="hidden" name="action" value="update" />
		<p class="submit">
		<input type="submit" class="button-primary" value="<?php _e('Save Changes') ?>" />
		</p>
	</div>
	</form>

<?php
}

@barinagabriel if you want to give me the Pro version, I wouldn’t say no ??

fixed in lib/CMInvitationCode.php:
change

public function getLimit() {
        if ($this->_registrationLimit == self::NO_LIMIT)

to

public function getLimit($raw = null) {
        if (!$raw && $this->_registrationLimit == self::NO_LIMIT)

and change

'registrationsLimit' => $this->getLimit(),
            'activationNeeded' => $this->isActivationNeeded(),

to

'registrationsLimit' => $this->getLimit(true),
            'activationNeeded' => (int) $this->isActivationNeeded(),

It’s to do with incorrect use of the prepare() method.

The whole point of it is for WordPress to do the escaping of parameters for you, but many plugin authors still write queries where prepare is either not needed (no parameters), or they’ve put the unescaped values into a query and think prepare() will magically know which parts of the resulting string need escaping. In this case, the plugin has one query that doesn’t need it:

in function secure_inviters_get_signups_by_code()
change $sql = $wpdb->prepare( "select count(u.ID) as signups,
to $sql = "select count(u.ID) as signups,
and order by count(u.ID) desc;" );
to order by count(u.ID) desc;";