Ultimate Member v2.13.0 - User Profile & Membership WordPress Plugin
Developer: Ultimate MemberCategory: WordPress PluginsTrusted with 252 downloadsPro2 favoritesLatest v2.13.0Updated 3w ago
The easiest way to create powerful online communities and beautiful user profiles with WordPress.
Same brand
More from Ultimate Member
Ultimate Member Verified Users Addon
by Ultimate Member
Add a user verficiation system to your site so users can request verification and be manually verified by site admin.
Ultimate Member Groups Addon
by Ultimate Member
Allow users to create and join groups around shared topics, interests etc.
Ultimate Member Private Content Addon
by Ultimate Member
With the private content extension you can provide logged in users with content that only they can access and view.
The easiest way to create powerful online communities and beautiful user profiles with WordPress.
Features
- Registration
- Login
- User Profiles
- User Roles
- Member Directories
- User Accounts
- Access Controls
- Custom Fields
- Form Builder
- Nav Menu Visibility
Registration
Users can easily register and become members all from the front-end of your site. Logged in users will never see the admin dashboard and will have no idea they are on a WordPress site.
-
Registration status
Decide a person’s status after registering on your site. You can allow users to be auto-approved, require email activation or be manually approved by the admin. -
Registration action
You can select the action that is taken after a person registers on your site. You can redirect them to their profile or redirect them to a custom url. -
Role assignment
You can assign a user role to a registration form so that anyone who registers using that form will automatically be assigned that specific role. -
Multiple registration forms
You can create multiple registration forms for your site so each user role has a unique registration form. -
Role selection
You can add a role selector field to the register form so users can select the role they want before they register. -
Default user role
You can assign a user role to be the default user role when users sign up on your site.
Recent releases
Release history
Aug 24, 20263.7 MB
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- gdpr-register.php
- profile.php
- *Deprecated**
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade.
- Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
- New user-capabilities functions `UM()->common()->users()->can_view_user()`, `UM()->common()->users()->get_privacy_setting()`, `UM()->common()->users()->is_user_profile_private()`, `UM()->common()->users()->get_restricted_privacy_notice()`, `UM()->common()->users()->can_view_private_user_profile()`, `UM()->common()->users()->can_view_user_profile()`. The future replacement for the `um_can_view_profile()` helper with different cases to check.
Improved
- Version of the WordPress native excluded functions to avoid the using them in the callbacks.
Fixed
- `WP_Filesystem()` initialization optimization. Init `WP_Filesystem()` only once when it's necessary.
- Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
- Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
- Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
- Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
- Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
- Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
- Member Directory type-button styles.
- Added fallback for the date and time fields to show date and time using the WordPress native format.
Removed
- Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native ` ` and ` ` instead.
v2.12.1Verified Safe
Jul 6, 20263.7 MB
View changelog
Other
- *Enhancements**
- *Bugfixes**
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value.
- The API key field type for the settings fields.
Fixed
- Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information).
- Security issue when accidentally `manage_options` level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar).
- Set size proportions during responsive handlers.
- mousewheel action during member directory loading and overlay is displayed.
- WP_Styles notice due to not loaded `um_modal` styles.
- oEmbed-type field styles.
v2.12.0
Jun 12, 20263.7 MB
View changelog
Other
- *Bugfixes**
- * Restricted `get_directory_by_hash()` function to only match posts with post_type='um_directory' and publish post status.
- * Used `0 =
Fixed
- Security issue, CVE ID: CVE-2026-7761.
Frequently asked questions
Is Ultimate Member GPL licensed?
Yes, Ultimate Member is distributed under the GNU General Public License (GPL). You can legally use, modify, and redistribute it on unlimited websites.
What is the latest version of Ultimate Member?
The latest version of Ultimate Member on GPLCoffee is v2.13.0 (released Aug 24, 2026, 3.7 MB download size). Every new release is synced automatically, and subscribers can update directly from their WordPress dashboard with the one-click connector plugin.
How much does Ultimate Member cost on GPLCoffee?
Ultimate Member is available for $5.99 for a 1-year license or $15.99 for a lifetime license. Membership plans also include credit-based access so you can download Ultimate Member along with thousands of other plugins, themes, and PHP scripts for a single subscription.
Which WordPress and PHP versions does Ultimate Member support?
The current release of Ultimate Member requires WordPress 6.2 or higher, tested up to WordPress 7.1, PHP 7.0 or higher. Per-release compatibility details are listed in the version history.
Is Ultimate Member safe to download?
Yes. The latest release of Ultimate Member (v2.13.0) was scanned with VirusTotal and came back clean. Scan results are visible on each version page, and releases flagged as malicious are blocked from the catalog.
Auto-updates included
Install it once, update automatically.
The GPLC Connector installs this plugin from your wp-admin and rolls out new versions to your connected sites - up to 25. Included with 12-month and Geek Lifetime plans (plus legacy 6-month).