Release v2.13.0
Ultimate Member v2.13.0
Latest versionWhat's new in v2.13.0
Ultimate Member v2.13.0 was released on . The easiest way to create powerful online communities and beautiful user profiles with WordPress. See the full changelog below and compare with the complete version history.
Release details
Released
3.7 MB
File available
Changelog
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- gdpr-register.php
- profile.php
- *Deprecated**
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade.
- Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
- New user-capabilities functions `UM()->common()->users()->can_view_user()`, `UM()->common()->users()->get_privacy_setting()`, `UM()->common()->users()->is_user_profile_private()`, `UM()->common()->users()->get_restricted_privacy_notice()`, `UM()->common()->users()->can_view_private_user_profile()`, `UM()->common()->users()->can_view_user_profile()`. The future replacement for the `um_can_view_profile()` helper with different cases to check.
Improved
- Version of the WordPress native excluded functions to avoid the using them in the callbacks.
Fixed
- `WP_Filesystem()` initialization optimization. Init `WP_Filesystem()` only once when it's necessary.
- Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
- Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
- Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
- Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
- Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
- Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
- Member Directory type-button styles.
- Added fallback for the date and time fields to show date and time using the WordPress native format.
Removed
- Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native ` ` and ` ` instead.
Compatibility
- Requires WordPress
- 6.2
- Tested up to
- 7.1
- Requires PHP
- 7.0
Verified safe
Ultimate Member v2.13.0 scanned clean with no security threats detected.
View full scan report