Thank you for your immediate response!
To clear things up again: I’m using X 6.5.6, not 5.6, lowercase x was meant as a placeholder, sorry for that. The installation in question only has X and Cornerstone installed and activated.
This might be an issue specific to X 6.5.6 which as far as I know is only available as a manual download from ThemeForest. I downloaded the package (“installable wordpress file only”) at about May 25th. Just redownloaded and it’s still the same file. It would be great if someone who has access to such an instance can check if this bug is reproducible. Any other relevant testing already has been done.
The issue ONLY occurs when clicking “Install” for any of the approved plugins on the validation page. Installing plugins - even the approved ones - otherwise works perfectly.
I further investigated this by stepping through the code: the key difference between installing a plugin via e.g. bulk extension manager (working) and by clicking “Install” on the validation page (not working) is that method TGM_Plugin_Activation::get_download_url()
is not called from the ajax installation routine. This results in the string literal repo
being handed over as the actual download url and that will finally cause this error.