Release v2.14.0
Ultimate Member v2.14.0
What's new in v2.14.0
Ultimate Member v2.14.0 was released on . The easiest way to create powerful online communities and beautiful user profiles with WordPress. See the full changelog below and compare with the complete version history.
Release details
Released
3.7 MB
File available
Changelog
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- profile/comments.php
- profile/posts.php
- login.php
- members.php
- profile.php
- register.php
- *Deprecated**
- Marked as deprecate soon: `in_group` attribute for the fields in the UM Forms builder.
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- `$form_id` parameter to the action hooks `um_before_form`, `um_before_{$mode}_fields`, `um_main_{$mode}_fields`, `um_after_form_fields`, `um_after_{$mode}_fields` and `um_after_form`.
- Action hook `um_before_render_dynamic_modal_content` for 3rd-party integration when the admin popup is opened.
- Filter hooks `um_email_validation_real_error_codes` and `um_email_validation_error_message` for 3rd-party integration to change or make visible the real error message for email fields validation.
- Threads field support in the UM Forms and Social Icons meta-row.
Fixed
- Security issue related to an unauthenticated PHP Object Injection vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added `um_maybe_unserialize()` function.
- Security issue related to administrator Stored SQL Injection via Directory Search-Field Identifiers. (Reported by Ananda Dhakal (Patchstack)). Added sanitizing for the searching fields in the member directory.
- Security issue related to an unauthenticated Improper Enforcement of Behavioral Workflow vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added unique nonce fields and attributes for requests.
- CVE-2026-96270 security issue. Added sanitizing for the form_id attribute during the Ultimate Member forms submission. (Reported by Wordfence).
- CVE-2026-93428 security issue. Fixed fields privacy when displaying the User Profile fields. (Reported by Wordfence).
- Security issue related to Privilege Escalation. Fixed user account submission and nonce security. Reset the user if it hasn't the ability to download the file. (Reported by Intrudify (Patchstack)).
- `is_url()` validation for the social links fields.
- `unique_email` validation. Parse primary and secondary email fields to make the email unique between them.
Removed
- `UM()->check_ajax_nonce` and `UM()->admin()->check_ajax_nonce()` functions. Use WordPress native `wp_verify_nonce()`, `check_admin_referer()` and `check_ajax_referer()` instead with unique nonce field values. Left them now for backward compatibility.
- Using `um_admin_scripts.nonce` and `um_scripts.nonce` localized data in UM scripts. Left them still localized for backward compatibility.
- JS common action for `'.um-ajax-action'` class. It's not used anymore in UM core and extensions and can be removed the same as AJAX handler for `um_muted_action`.
- Action hook `um_run_ajax_function__{$hook}` used in the `um_muted_action` handler.
Compatibility
- Requires WordPress
- 6.2
- Tested up to
- 7.1
- Requires PHP
- 7.0
Verified safe
Ultimate Member v2.14.0 scanned clean with no security threats detected.
View full scan report