# Ultimate Member `meteorgpl-plugin/ultimate-member` — a WordPress plugin as a Composer package. The easiest way to create powerful online communities and beautiful user profiles with WordPress - Author: Ultimate Member — http://ultimatemember.com/ - Homepage: http://ultimatemember.com/ - License: not declared - Buy a license from the vendor: http://ultimatemember.com/ - Page: https://meteorgpl.com/packages/meteorgpl-plugin/ultimate-member - Requires WordPress: 6.2 - Tested up to WordPress: 7.1 - Requires PHP: 7.0 - Translations: en_US - Vendor: Ultimate Member — https://meteorgpl.com/vendors/ultimatemember.com ## About = User Profile & Membership Plugin for WordPress = The ultimate user profile & membership plugin for WordPress. The plugin makes it a breeze for users to sign-up and become members of your website. The plugin allows you to add beautiful user profiles to your site and is designed for creating advanced online communities and membership sites. Lightweight and highly extendible, Ultimate Member will enable you to create almost any type of site where users can join and become members with absolute ease. = Features of the plugin include: = * Front-end user profiles * Front-end user registration * Front-end user login * Custom form fields * Conditional logic for form fields * Drag and drop form builder * User account page * Custom user roles * Member directories * User emails * Content restriction * Conditional nav menus * Show author posts & comments on user profiles * Developer friendly with dozens of actions and filters Read about all of the plugin's features at [Ultimate Member](https://ultimatemember.com) = Paid Extensions = Ultimate Member has a range of extensions that allow you to extend the power of the plugin. You can purchase all of these extensions at a significant discount with one of our [paid plans](https://ultimatemember.com/pricing/) or you can purchase extensions individually. * [Zapier](https://ultimatemember.com/extensions/zapier/) - Allow to integrate the Zapier popular apps with Ultimate Member * [Stripe](https://ultimatemember.com/extensions/stripe/) - Sell paid memberships to access your website via Stripe subscriptions * [User Notes](https://ultimatemember.com/extensions/user-notes/) - Allow users to create public and private notes from their profile * [Profile Tabs](https://ultimatemember.com/extensions/profile-tabs/) - Allow to add the custom tabs to profiles * [User Locations](https://ultimatemember.com/extensions/user-locations/) - Allow to display users on a map on the member directory page and allow users to add their location via their profile * [Unsplash](https://ultimatemember.com/extensions/unsplash/) - Allow users to select a profile cover photo from [Unsplash](https://unsplash.com/) from their profile * [User Bookmarks](https://ultimatemember.com/extensions/user-bookmarks/) - Allow users to bookmark content from your website * [User Photos](https://ultimatemember.com/extensions/user-photos/) - Allow users to upload photos to their profile * [Groups](https://ultimatemember.com/extensions/groups/) - Allow users to create and join groups around shared topics, interests etc. * [Private Content](https://ultimatemember.com/extensions/private-content/) - Display private content to logged in users that only they can access * [User Tags](https://ultimatemember.com/extensions/user-tags/) - Lets you add a user tag system to your website * [Social Activity](https://ultimatemember.com/extensions/social-activity/) - Let users create public wall posts & see the activity of other users * [WooCommerce](https://ultimatemember.com/extensions/woocommerce/) - Allow you to integrate WooCommerce with Ultimate Member * [Private Messages](https://ultimatemember.com/extensions/private-messages/) - Add a private messaging system to your site & allow users to message each other * [Followers](https://ultimatemember.com/extensions/followers/) - Allow users to follow each other on your site and protect their profile information * [Real-time Notifications](https://ultimatemember.com/extensions/real-time-notifications/) - Add a notifications system to your site so users can receive real-time notifications * [Social Login](https://ultimatemember.com/extensions/social-login/) - Let users register & login to your site via Facebook, Twitter, G+, LinkedIn, Instagram and Vkontakte (VK.com) * [bbPress](https://ultimatemember.com/extensions/bbpress/) - With the bbPress extension you can beautifully integrate Ultimate Member with bbPress * [MailChimp](https://ultimatemember.com/extensions/mailchimp/) - Allow users to subscribe to your MailChimp lists when they signup on your site and sync user meta to MailChimp * [User Reviews](https://ultimatemember.com/extensions/user-reviews/) - Allow users to rate & review each other using a 5 star rate/review system * [Verified Users](https://ultimatemember.com/extensions/verified-users/) - Add a user verification system to your site so user accounts can be verified * [myCRED](https://ultimatemember.com/extensions/mycred/) - With the myCRED extension you can integrate Ultimate Member with the popular myCRED points management plugin * [Notices](https://ultimatemember.com/extensions/notices/) - Alert users to important information using conditional notices * [Profile Completeness](https://ultimatemember.com/extensions/profile-completeness/) - Encourage or force users to complete their profiles with the profile completeness extension * [Friends](https://ultimatemember.com/extensions/friends/) - Allows users to become friends by sending & accepting/rejecting friend requests = Free Extensions = * [JobsBoardWP](https://ultimatemember.com/extensions/jobboardwp/) - This free extension integrates Ultimate Member with the job board plugin [JobBoardWP](https://wordpress.org/plugins/jobboardwp). * [ForumWP](https://ultimatemember.com/extensions/forumwp/) - This free extension integrates Ultimate Member with the forum plugin [ForumWP](https://forumwpplugin.com). * [Terms & Conditions](https://ultimatemember.com/extensions/terms-conditions/) - Add a terms and condition checkbox to your registration forms & require users to agree to your T&Cs before registering on your site. * [Google reCAPTCHA](https://ultimatemember.com/extensions/google-recaptcha/) - Stop bots on your registration & login forms with Google reCAPTCHA * [Online Users](https://ultimatemember.com/extensions/online-users/) - Display what users are online with this extension = Theme = Our official [theme](https://ultimatemember.com/theme/) is purpose built for websites that have logged in and out users. The [theme](https://ultimatemember.com/theme/) has deep integration with Ultimate Member plugin and the extensions, different header designs for logged-in/out users and works alongside the Beaver Builder and Elementor page builders. = Our other plugins = In addition to Ultimate Member, we also have two other plugins: [ForumWP](https://forumwpplugin.com/) and [JobBoardWP](https://wordpress.org/plugins/jobboardwp). = ForumWP = [ForumWP](https://forumwpplugin.com/) is a forum plugin which adds an online forum to your website, allowing users to create topics and write replies. Forums are a great way to build and grow an online community. = JobBoardWP = [JobBoardWP](https://wordpress.org/plugins/jobboardwp) is a job board plugin which adds a modern job board to your website. Display job listings and allow employers to submit and manage jobs all from the front-end. = Development * Translations = If you're a developer and would like to contribute to the source code of the plugin you can do so via our [GitHub Repository](https://github.com/ultimatemember/ultimatemember). Want to add a new language to Ultimate Member? Great! You can contribute via [translate.wordpress.org](https://translate.wordpress.org/projects/wp-plugins/ultimate-member). If you are a developer and you need to know the list of UM Hooks, make this via our [Hooks Documentation](https://docs.ultimatemember.com/article/1324-hooks-list) or [Hooks Documentation v2](https://ultimatemember.github.io/ultimatemember/hooks/). If you are a developer and you need to know the structure of our code, make this via our [Documentation API](https://ultimatemember.github.io/ultimatemember/phpdoc/). = Documentation & Support = Got a problem or need help with Ultimate Member? Head over to our [documentation](http://docs.ultimatemember.com/) and perform a search of the knowledge base. If you can’t find a solution to your issue then you can create a topic on the [support forum](https://wordpress.org/support/plugin/ultimate-member). ## Changelog ### 2.14.0 — 2026-09-29 * Enhancements: - Added: `$form_id` parameter to the action hooks `um_before_form`, `um_before_{$mode}_fields`, `um_main_{$mode}_fields`, `um_after_form_fields`, `um_after_{$mode}_fields` and `um_after_form`. - Added: Action hook `um_before_render_dynamic_modal_content` for 3rd-party integration when the admin popup is opened. - Added: Filter hooks `um_email_validation_real_error_codes` and `um_email_validation_error_message` for 3rd-party integration to change or make visible the real error message for email fields validation. - Added: Threads field support in the UM Forms and Social Icons meta-row. * Bugfixes: - Fixed: Security issue related to an unauthenticated PHP Object Injection vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added `um_maybe_unserialize()` function. - Fixed: Security issue related to administrator Stored SQL Injection via Directory Search-Field Identifiers. (Reported by Ananda Dhakal (Patchstack)). Added sanitizing for the searching fields in the member directory. - Fixed: Security issue related to an unauthenticated Improper Enforcement of Behavioral Workflow vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added unique nonce fields and attributes for requests. - Fixed: CVE-2026-96270 security issue. Added sanitizing for the form_id attribute during the Ultimate Member forms submission. (Reported by Wordfence). - Fixed: CVE-2026-93428 security issue. Fixed fields privacy when displaying the User Profile fields. (Reported by Wordfence). - Fixed: Security issue related to Privilege Escalation. Fixed user account submission and nonce security. Reset the user if it hasn't the ability to download the file. (Reported by Intrudify (Patchstack)). - Fixed: `is_url()` validation for the social links fields. - Fixed: `unique_email` validation. Parse primary and secondary email fields to make the email unique between them. * Templates Requiring Update: - profile/comments.php - profile/posts.php - login.php - members.php - profile.php - register.php * Deprecated: - Deprecated: `UM()->check_ajax_nonce` and `UM()->admin()->check_ajax_nonce()` functions. Use WordPress native `wp_verify_nonce()`, `check_admin_referer()` and `check_ajax_referer()` instead with unique nonce field values. Left them now for backward compatibility. - Deprecated: Using `um_admin_scripts.nonce` and `um_scripts.nonce` localized data in UM scripts. Left them still localized for backward compatibility. - Deprecated: JS common action for `'.um-ajax-action'` class. It's not used anymore in UM core and extensions and can be removed the same as AJAX handler for `um_muted_action`. - Deprecated: Action hook `um_run_ajax_function__{$hook}` used in the `um_muted_action` handler. - Marked as deprecate soon: `in_group` attribute for the fields in the UM Forms builder. * Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade * ### 2.13.1 — 2026-09-15 * Enhancements: - Added: Fallback for `wp-cli/wp-config-transformer` library if the wp-config.php file isn't writable. - Added: Filter hook `um_members_directory_filter_text` 3rd parameter `$is_default` to check if it's admin filtering or frontend query. - Added: 'Administrative capabilities ban' option enabled by default after the first installation. - Optimized: Slow SQL query for batch empty account status check. - Optimized: Set the recurring action for account status check as unique. - Optimized: Redundant SQL calls when editing Profile page with callback dropdowns. Cached usermeta existence checks per user and key during a single load (Reported by @MissVeronica, author @faisalahammad). * Bugfixes: - Fixed: Security issue related to an unauthenticated visitor can store JavaScript that runs in an administrator's session, through their own profile name. (Reported by Karthik Ramakrishnan and WPScan team). Fixed `um_convert_tags()` function and applied the escapers throughout the placeholder replacement. - Fixed: Using LIKE compare for the text-type filters with custom usermeta table (Reported by @MissVeronica, author @faisalahammad). - Fixed: "Can user edit this field?" field setting displaying only for the User Profile form fields. - Fixed: Getting the pages list in the wp-admin UM > Settings > General > Pages section. - Fixed: Displaying the field-type time on the User Profile page. - Fixed: Using `illegal_user_logins` for current admin user with the username specified in the illegal user logins list. * Deprecated: - Deprecated: Filter hook `um_members_directory_filter_text_meta_value` is fully deprecated, replacement isn't required for the text-type filter field. ### 2.13.0 — 2026-08-24 * Enhancements: - Added: Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade. - Added: Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB. - Added: New user-capabilities functions `UM()->common()->users()->can_view_user()`, `UM()->common()->users()->get_privacy_setting()`, `UM()->common()->users()->is_user_profile_private()`, `UM()->common()->users()->get_restricted_privacy_notice()`, `UM()->common()->users()->can_view_private_user_profile()`, `UM()->common()->users()->can_view_user_profile()`. The future replacement for the `um_can_view_profile()` helper with different cases to check. - Updated: Version of the WordPress native excluded functions to avoid the using them in the callbacks. * Bugfixes: - Fixed: `WP_Filesystem()` initialization optimization. Init `WP_Filesystem()` only once when it's necessary. - Fixed: Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions). - Fixed: Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions). - Fixed: Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions). - Fixed: Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)). - Fixed: Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman). - Fixed: Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields. - Fixed: Member Directory type-button styles. - Fixed: Added fallback for the date and time fields to show date and time using the WordPress native format. * Templates Requiring Update: - gdpr-register.php - profile.php * Deprecated: - Deprecated: Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native `` and `` instead. * Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade * ### 2.12.1 — 2026-07-06 * Enhancements: - Added: Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value. - Added: The API key field type for the settings fields. * Bugfixes: - Fixed: Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information). - Fixed: Security issue when accidentally `manage_options` level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar). - Fixed: Set size proportions during responsive handlers. - Fixed: mousewheel action during member directory loading and overlay is displayed. - Fixed: WP_Styles notice due to not loaded `um_modal` styles. - Fixed: oEmbed-type field styles. * Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade * ### 2.12.0 — 2026-06-12 * Bugfixes: - Fixed: Security issue, CVE ID: CVE-2026-7761. - Restricted `get_directory_by_hash()` function to only match posts with post_type='um_directory' and publish post status. - Used `0 === strpos()` instead of `strstr()` for getting proper post_data. - Added condition for getting only allowed fields in tagline_fields and reveal_fields to `build_user_card_data()`. - Fixed: Security issue, CVE ID: CVE-2026-8489. - Used WordPress native `wp_kses()` escaper for displaying user_description field. Used WordPress native `make_clickable()` function to make raw links clickable. - Fixed: Security issue, CVE ID: CVE-2026-xxxx. Make the role and status visible for the user who can edit these users in the request. Reported by [Ben Tamam](bentamam.github.io). - Fixed: Remove UM option function when the option value equals "0". * Deprecated: - Temporary deprecated: UM REST API. Legacy feature that has to be refactored. Will be refactored and re-released soon. Full changelog: https://meteorgpl.com/packages/meteorgpl-plugin/ultimate-member/changelog ## Install ```sh composer config repositories.meteorgpl composer https://composer.meteorgpl.com composer require meteorgpl-plugin/ultimate-member ``` The repository needs a token (see https://meteorgpl.com/docs). The vendor's license checks are intact: activate the plugin in WordPress with a key bought from the vendor. ## Versions No version has been published yet.