Ultimate Member v2.14.1 - User Profile & Membership WordPress Plugin
Developer: Ultimate MemberCategory: WordPress PluginsTrusted with 252 downloadsPro2 favoritesLatest v2.14.1Updated 1w ago
The easiest way to create powerful online communities and beautiful user profiles with WordPress.
Same brand
More from Ultimate Member
Ultimate Member Groups Addon
by Ultimate Member
Allow users to create and join groups around shared topics, interests etc.
Ultimate Member Social Login Addon
by Ultimate Member
The social login extension allows users to easily register/login to your site using their social network accounts
Ultimate Member Verified Users Addon
by Ultimate Member
Add a user verficiation system to your site so users can request verification and be manually verified by site admin.
The easiest way to create powerful online communities and beautiful user profiles with WordPress.
Features
- Registration
- Login
- User Profiles
- User Roles
- Member Directories
- User Accounts
- Access Controls
- Custom Fields
- Form Builder
- Nav Menu Visibility
Registration
Users can easily register and become members all from the front-end of your site. Logged in users will never see the admin dashboard and will have no idea they are on a WordPress site.
-
Registration status
Decide a person’s status after registering on your site. You can allow users to be auto-approved, require email activation or be manually approved by the admin. -
Registration action
You can select the action that is taken after a person registers on your site. You can redirect them to their profile or redirect them to a custom url. -
Role assignment
You can assign a user role to a registration form so that anyone who registers using that form will automatically be assigned that specific role. -
Multiple registration forms
You can create multiple registration forms for your site so each user role has a unique registration form. -
Role selection
You can add a role selector field to the register form so users can select the role they want before they register. -
Default user role
You can assign a user role to be the default user role when users sign up on your site.
Recent releases
Release history
Oct 23, 20263.7 MB
Other
- *Bugfixes**
Fixed
- CVE-2026-107625 security issue. Added confirmation prompt for external links and improve localization support in frontend scripts. (Reported by Wordfence).
- Reading the icons' list via `UM()->setup()->get_icons_list()`. This function provides a static in-memory fallback if the DB option is missing or unreadable.
v2.14.0Verified Safe
Sep 29, 20263.7 MB
View changelog
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- profile/comments.php
- profile/posts.php
- login.php
- members.php
- profile.php
- register.php
- *Deprecated**
- Marked as deprecate soon: `in_group` attribute for the fields in the UM Forms builder.
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- `$form_id` parameter to the action hooks `um_before_form`, `um_before_{$mode}_fields`, `um_main_{$mode}_fields`, `um_after_form_fields`, `um_after_{$mode}_fields` and `um_after_form`.
- Action hook `um_before_render_dynamic_modal_content` for 3rd-party integration when the admin popup is opened.
- Filter hooks `um_email_validation_real_error_codes` and `um_email_validation_error_message` for 3rd-party integration to change or make visible the real error message for email fields validation.
- Threads field support in the UM Forms and Social Icons meta-row.
Fixed
- Security issue related to an unauthenticated PHP Object Injection vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added `um_maybe_unserialize()` function.
- Security issue related to administrator Stored SQL Injection via Directory Search-Field Identifiers. (Reported by Ananda Dhakal (Patchstack)). Added sanitizing for the searching fields in the member directory.
- Security issue related to an unauthenticated Improper Enforcement of Behavioral Workflow vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added unique nonce fields and attributes for requests.
- CVE-2026-96270 security issue. Added sanitizing for the form_id attribute during the Ultimate Member forms submission. (Reported by Wordfence).
- CVE-2026-93428 security issue. Fixed fields privacy when displaying the User Profile fields. (Reported by Wordfence).
- Security issue related to Privilege Escalation. Fixed user account submission and nonce security. Reset the user if it hasn't the ability to download the file. (Reported by Intrudify (Patchstack)).
- `is_url()` validation for the social links fields.
- `unique_email` validation. Parse primary and secondary email fields to make the email unique between them.
Removed
- `UM()->check_ajax_nonce` and `UM()->admin()->check_ajax_nonce()` functions. Use WordPress native `wp_verify_nonce()`, `check_admin_referer()` and `check_ajax_referer()` instead with unique nonce field values. Left them now for backward compatibility.
- Using `um_admin_scripts.nonce` and `um_scripts.nonce` localized data in UM scripts. Left them still localized for backward compatibility.
- JS common action for `'.um-ajax-action'` class. It's not used anymore in UM core and extensions and can be removed the same as AJAX handler for `um_muted_action`.
- Action hook `um_run_ajax_function__{$hook}` used in the `um_muted_action` handler.
v2.13.1Verified Safe
Sep 15, 20263.7 MB
View changelog
Other
- *Enhancements**
- *Bugfixes**
- *Deprecated**
Added
- Fallback for `wp-cli/wp-config-transformer` library if the wp-config.php file isn't writable.
- Filter hook `um_members_directory_filter_text` 3rd parameter `$is_default` to check if it's admin filtering or frontend query.
- 'Administrative capabilities ban' option enabled by default after the first installation.
Improved
- Slow SQL query for batch empty account status check.
- Redundant SQL calls when editing the Profile page with callback dropdowns. Cached usermeta existence checks per user and key during a single load (Reported by @MissVeronica, author @faisalahammad).
Fixed
- Security issue related to an unauthenticated visitor can store JavaScript that runs in an administrator's session, through their own profile name. (Reported by Karthik Ramakrishnan and WPScan team). Fixed `um_convert_tags()` function and applied the escapers throughout the placeholder replacement.
- Using LIKE compare for the text-type filters with custom usermeta table (Reported by @MissVeronica, author @faisalahammad).
- "Can user edit this field?" field setting displaying only for the User Profile form fields.
- Getting the pages list in the wp-admin UM > Settings > General > Pages section.
- Displaying the field-type time on the User Profile page.
- Using `illegal_user_logins` for the current admin user with the username specified in the illegal user logins list.
Removed
- Filter hook `um_members_directory_filter_text_meta_value` is fully deprecated, replacement isn't required for the text-type filter field.
Frequently asked questions
Is Ultimate Member GPL licensed?
Yes, Ultimate Member is distributed under the GNU General Public License (GPL). You can legally use, modify, and redistribute it on unlimited websites.
What is the latest version of Ultimate Member?
The latest version of Ultimate Member on GPLCoffee is v2.14.1 (released Oct 23, 2026, 3.7 MB download size). Every new release is synced automatically, and subscribers can update directly from their WordPress dashboard with the one-click connector plugin.
How much does Ultimate Member cost on GPLCoffee?
Ultimate Member is available for $5.99 for a 1-year license or $15.99 for a lifetime license. Membership plans also include credit-based access so you can download Ultimate Member along with thousands of other plugins, themes, and PHP scripts for a single subscription.
Which WordPress and PHP versions does Ultimate Member support?
The current release of Ultimate Member requires WordPress 6.2 or higher, tested up to WordPress 7.1, PHP 7.0 or higher. Per-release compatibility details are listed in the version history.
Is Ultimate Member safe to download?
Yes. The latest release of Ultimate Member (v2.14.1) was scanned with VirusTotal and came back clean. Scan results are visible on each version page, and releases flagged as malicious are blocked from the catalog.
Auto-updates included
Install it once, update automatically.
The GPLC Connector installs this plugin from your wp-admin and rolls out new versions to your connected sites. Included with every membership plan: 10 to 40 connected sites depending on the plan (Lite 10, Pro 20, Geek and Lifetime 40).