Ultimate Member Core Plugin
/Year
What is Ultimate Member Core Plugin?
Ultimate Member Core Plugin is a powerful and flexible solution designed for WordPress site owners, developers, and community managers who want to build fully featured membership platforms, user profile hubs, and online communities. By providing streamlined frontend interfaces, the plugin allows users to register, log in, manage their accounts, and interact with other members without ever needing to access the default WordPress backend dashboard. It bridges the gap between basic WordPress capabilities and advanced community portals.
Latest Version 2.13.0 Changes
The Ultimate Member Core Plugin version 2.13.0 (released on August 24, 2026) includes multiple significant security patches, including fixes for CVE-2026-18547, unauthenticated privilege escalation, and unauthorized reading of pending comments. It brings enhancements like storing API keys in wp-config.php via wp-cli/wp-config-transformer, introduces new user-capability functions, and resolves bugs such as registration form infinite loops and REST API nonce invalidations. The update also deprecates Pickadate.js and Pickatime.js libraries.
- Added: Using illegaluserlogins filter to sanitize the userlogin field value during registration or upgrade.
- Added: Using wp-cli/wp-config-transformer library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
- Added: New user-capabilities functions (such as UM()->common()->users()->canviewuser(), etc.) as a future replacement for the umcanviewprofile() helper.
- Updated: Version of the WordPress native excluded functions to avoid using them in the callbacks.
- Fixed: WP_Filesystem() initialization optimization (initialized only once when necessary).
- Fixed: Redirect on non-main queries that breaks Spectra and block themes.
What Does Ultimate Member Do?
The plugin handles all core aspects of user management and community building on a WordPress website. It empowers site administrators to create customized registration and login forms with drag-and-drop fields, set up searchable member directories to display user profiles, and restrict specific content or entire pages based on user roles or login status. Additionally, it provides granular control over user roles and permissions, ensuring that members only see and interact with what they are authorized to access.
Who Is Ultimate Member For?
Ultimate Member is tailored for a diverse range of website creators. Online course creators can use it to manage student accounts and restrict learning materials. Community builders and forum managers rely on it to foster user engagement through public directories and custom profiles. Membership site owners utilize its robust access control tools to protect premium content, while digital agencies deploy it as a reliable foundation for client projects that require complex user management workflows.
Key Capabilities and Features
The plugin comes packed with essential tools for running a modern membership site. Its core features include front-end user registration, customizable login forms, and beautifully designed user profile pages. Administrators can build dynamic member directories with advanced search and filtering options, apply content restriction rules to posts, pages, and menus, and manage user roles efficiently from the WordPress dashboard.
Practical WordPress Use Cases
Ultimate Member adapts seamlessly to various website models. You can build a niche social network where users create personal profiles and connect with peers. It functions exceptionally well for alumni networks, corporate intranets, client portals, and subscription-based content hubs where exclusive articles or downloads must be hidden from non-paying visitors. Its flexibility makes it suitable for both small blogs and large-scale membership platforms.
Setup and Compatibility Notes
Installing Ultimate Member is straightforward. Upon activation, the plugin automatically creates essential pages such as user registration, login, profile, and account management. It integrates cleanly with standard WordPress themes and popular page builders. Administrators should ensure that permalinks are configured correctly and that caching plugins are set up to avoid caching dynamic membership pages for logged-out visitors.
Reasons to Choose Ultimate Member on WPPick
Choosing Ultimate Member on WPPick gives you access to a reliable, feature-rich membership plugin at an exceptional value. It eliminates the complexity of coding custom user registration systems from scratch, saving time and development costs while delivering a polished, professional user experience on your WordPress website.
Latest Version Context
The latest version 2.13.0 introduces critical security patches, including fixes for CVE-2026-18547, unauthenticated privilege escalation, and unauthorized reading of pending comments. It also brings performance enhancements such as storing API keys securely in wp-config.php via the wp-config-transformer library, introduces new user-capability functions, resolves registration form infinite loops, and deprecates legacy Pickadate libraries in favor of native HTML fields.
Frequently Asked Questions
Can I restrict specific pages to certain user roles? Yes, Ultimate Member allows you to restrict content on a global or per-page basis, ensuring only designated user roles can view specific materials.
Does the plugin support custom registration fields? Yes, you can easily add custom text, dropdown, checkbox, and file upload fields to your registration and profile forms using the form builder.
Are member directories searchable? Yes, the member directory feature includes built-in search and filtering tools so visitors can easily find other members based on profile details.
Can users edit their own profiles from the frontend? Absolutely. Members can log in and update their profile information, upload avatars, change passwords, and manage account settings directly from the frontend.
Is Ultimate Member compatible with caching plugins? Yes, but you must ensure that dynamic membership pages like login and account dashboards are excluded from page caching to prevent display errors.
I. Download Limits & Account Benefits
- Free Downloads: Each email address receives 3 downloads per day for free products
- Upgrade Benefits: Purchase any paid product to increase your daily download limit by 3 for each paid product
- No Account Required: You can download immediately by receiving the download link via email
- Account Recommended: Create an account for easier access to your order history and direct update downloads
II. Understanding GPL vs Official Versions
Important: The products available on WPPick are GPL-licensed versions, which differ from official developer versions. Before purchasing, please read our comprehensive guide: Understanding GPL & Official Differences at WPPick
Key Points:
- GPL versions may not include premium support from original developers
- Updates may be delayed compared to official releases
- Some premium features might have limitations
- Always consider your specific needs and support requirements
III. Support & Assistance
We’re here to help through multiple channels:
- Email Support: Direct email assistance for all inquiries
- Live Chat: Real-time support during business hours
- Comprehensive Documentation: Detailed guides and tutorials
IV. Order Tracking
Access your complete purchase history and download links anytime: Order History
V. Account Access
New to WPPick? Login or Create Account to manage your downloads and orders efficiently.
VI. Refund Protection
We stand behind our products with a clear refund policy. Review our terms: Refund Policy
VII. Privacy & Security
Your data security is our priority. Learn how we protect your information: Privacy Policy
VII. Terms of Service
Understanding our service terms ensures a smooth experience: Terms of Use
Quick Tips for Best Experience
- Verify Compatibility: Check plugin/theme compatibility with your WordPress version
- Backup First: Always backup your site before installing new plugins or themes
- Test Environment: Consider testing on a staging site first
- Stay Updated: Regularly check for updates in your account dashboard
- Read Documentation: Review any included documentation for optimal setup
Need Help?
If you have questions about downloads, licensing, or need technical assistance, don’t hesitate to contact our support team. We’re committed to ensuring you have the best possible experience with WPPick products.
Ready to get started? Your download adventure begins with just one click!
- Added: Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade.
- Added: New user-capabilities functions `UM()->common()->users()->can_view_user()`, `UM()->common()->users()->get_privacy_setting()`, `UM()->common()->users()->is_user_profile_private()`, `UM()->common()->users()->get_restricted_privacy_notice()`, `UM()->common()->users()->can_view_private_user_profile()`, `UM()->common()->users()->can_view_user_profile()`. The future replacement for the `um_can_view_profile()` helper with different cases to check.
- Added: Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
- Updated: Version of the WordPress native excluded functions to avoid the using them in the callbacks.
- Fixed: `WP_Filesystem()` initialization optimization. Init `WP_Filesystem()` only once when it's necessary.
- Fixed: Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
- Fixed: Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
- Fixed: Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
- Fixed: Member Directory type-button styles.
- Fixed: Added fallback for the date and time fields to show date and time using the WordPress native format.
- Fixed: Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
- Fixed: Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
- Fixed: Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields.
- Deprecated: Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native `<input type="date" />` and `<input type="time" />` instead.
- Templates Requiring Update: gdpr-register.php, profile.php
- Added: Server-side validation when the Search Form is submitted.
- Added: Action hook `um_approve_user_on_email_confirmation` to natively approve the user after validating the email activation link.
- Added: JS filter wp.hook `um_member_directory_popstate_ignore` to stop window.pushSate in the member directory for 3rd-party integrations.
- Fixed: Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in `wp_kses()`.
- Fixed: Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.
- Fixed: Profile photo dropdown menu position for screens smaller than 340px.
- Fixed: Display of the saved value of the "Privacy Options" > "Allowed roles" setting for the member directory.
- Fixed: Information in Site-Health about the registration form's `Template` and `Role` settings.
- Fixed: Information in Site-Health about the login and profile form's `Template` settings.
- Templates Requiring Update: members.php, searchform.php.
- Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade.
- Added: 'Privacy Options' for Member Directory. 'Who can see this member directory' and 'Allowed Roles'.
- Added: 'Rate Limit' setting for nopriv AJAX actions.
- Fixed: Security issue CVE ID: CVE-2025-13220. Used `shortcode_atts()` function to avoid using wrong attributes.
- Fixed: Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.
- Fixed: Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.
- Fixed: Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.
- Templates required update: members.php, members-grid.php, members-list.php.
- Extra condition for checking the license activation requests.
- 2nd `$args` attribute to the action hook 'um_cover_area_content'.
- `$args` and `$user_id` attributes to the action hook 'um_after_profile_header_name'.
- Class `um-profile-subnav-{$subnav_id}-link` to the sub navigation links in the User Profile page.
- Updated `Extensions_Updater` class to use Action Scheduler in the upgrade process of the UM extensions.
- User profile links in the comments section on the frontend when the `$comment->user_id` is empty.
- The `emotize` function regexp for better emoji converting.
- The conflict between the image uploader and lazy-loading attribute added by 3rd-party plugins.
- PHP warnings for roles without meta data.
- Typo in labels.
- Added: Avoid caching of the UM Forms on the mobile devices via adding the nocache headers to the screens with UM Forms.
- Added: Filter hook `um_get_empty_status_users_query_result` for changing default query on the different websites to optimize it.
- Added: Filter hook `um_admin_settings_get_pages_list_args` for changing WP_Query arguments for getting pages visible in the dropdown fields in UM Settings.
- Added: JS filter hook `um_admin_blocks_prefixes_excluded` for excluding 3rd-party Gutenberg blocks with predefined prefixes from UM restriction arguments.
- Added: WebP file-extension support for UM uploader.
- Added: `UM_LICENSE_REQUEST_DEBUG` constant for debugging license activation process when it's needed.
- Added: `Extensions_Updater` class to standardize the upgrade process in UM extensions.
- Added: Sanitize handlers `sanitize_array_key_int` and `sanitize_array_key` for making sanitize in UM extensions' settings.
- Fixed: Changed the view and the edit user profile links in the comments section on the frontend.
- Fixed: `Contains` conditional logic operand when value is array.
- Fixed: Getting cover_size for displaying it in the member directory card.
- Fixed: Filter's range for numeric-type fields to avoid getting the empty values.
- Fixed: Integer validation for the 'start_of_week' WP native setting.
- Fixed: Dependencies with Action Scheduler library.
- Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after upgrade.
- Added: Filter hook um_password_reset_form_primary_btn_classes for primary button classes in UM Password Reset form
- Added: Filter hook um_login_form_primary_btn_classes for primary button classes in UM Login form
- Added: Filter hook um_register_form_primary_btn_classes for primary button classes in UM Registration form
- Tweak: Refactored Site Health data, added hooks for 3rd-party integration
- Tweak: Avoid using um_user( 'password_reset_link' ) and make it directly with UM()->password()->reset_url( $user_id ) for getting a proper reset URL
- Tweak: Avoid using um_user( 'account_activation_link' ) and make it directly with UM()->permalinks()->activate_url( $user_id ) for getting a proper activation URL
- Fixed: Stripped shortcodes in the user data during the Account, Registration and Profile forms submission
- Fixed: Email placeholders values
- Fixed: Refactor deactivation logic to un-schedule Action Scheduler actions
- Fixed: Action Scheduler library errors. Updated to the recent 3.9.2 version
- Fixed: Secondary email field validation
- Fixed: Action Scheduler batch actions with users who have Undefined status
- Fixed: Restrictions for 3rd-party Gutenberg Blocks
- Fixed: Date/time picker filter-types range query on Member Directories
- Fixed: Renamed "Macedonia, the former Yugoslav Republic of" to the official "North Macedonia"
- Fully deprecated account_activation_link_tags_patterns( $placeholders ) function. It's not used previously. Used email function arguments instead
- Fully deprecated account_activation_link_tags_replaces( $replace_placeholders ) function. It's not used previously. Used email function arguments instead
- Fully deprecated UM()->profile()->add_placeholder() function. Used email function arguments instead
- Fully deprecated UM()->profile()->add_replace_placeholder() function. Used email function arguments instead
- Fully deprecated UM()->user()->add_activation_placeholder() function. Used email function arguments instead
- Fully deprecated UM()->user()->add_activation_replace_placeholder() function. Used email function arguments instead
- Deprecated UM()->user()->maybe_generate_password_reset_key( $userdata ) function. Use UM()->common()->users()->maybe_generate_password_reset_key( $userdata ) instead
- Deprecated UM()->user()->set_last_login() function. Use UM()->common()->users()->set_last_login( $user_id ) instead