Restores the Paid Memberships Pro update package URL offered in the update transient if another plugin (e.g. thim-core) swaps it at download time. Stopgap until PMPro Update Manager ships a built-in guard; remove after that release.

pmpro-protect-update-package.php

<?php
/**
 * Plugin Name: PMPro Hosting - Protect PMPro Update Package
 * Description: Restores the Paid Memberships Pro update package URL offered in the update transient if another plugin (e.g. thim-core) swaps it at download time. Stopgap until PMPro Update Manager ships a built-in guard; remove after that release.
 * Author: Paid Memberships Pro
 */

add_filter( 'upgrader_package_options', function ( $options ) {
	$plugin = isset( $options['hook_extra']['plugin'] ) ? $options['hook_extra']['plugin'] : '';
	if ( 'paid-memberships-pro/paid-memberships-pro.php' !== $plugin ) {
		return $options;
	}

	$transient = get_site_transient( 'update_plugins' );
	$offered   = isset( $transient->response[ $plugin ]->package ) ? $transient->response[ $plugin ]->package : '';

	if ( $offered && $offered !== $options['package'] ) {
		$message = 'PMPro package guard: restored update package for ' . $plugin . ' (hijacked URL was: ' . $options['package'] . ')';
		if ( class_exists( 'PMPro_Hosting_Core' ) && method_exists( 'PMPro_Hosting_Core', 'log' ) ) {
			PMPro_Hosting_Core::log( 'WARNING', $message );
		} else {
			error_log( $message );
		}
		$options['package'] = $offered;
	}

	return $options;
}, 999 );