Access Governance for WordPress (aka AAM)

Reviewers keep calling it the best access control plugin they've found and praise the support, though one recent reviewer hit conflicts with other plugins and got locked out of their own admin.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

138 searches this plugin appeared in over the last 90 days, 20 listed. 113 left out as unrelated or noise (years, numbers, stray words). 3 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 7.8 years ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ Sepi

   1.1y ago

   very good plugin.

   Read on wp.org ↗
2. ★★★★★ yungcyang

   1.8y ago

   I have been looking for a plugin to manage user access and AAM is by far the best of all. Highly recommended.

   Read on wp.org ↗
3. ★★★★★ Vassos Hadjivassiliou

   2.1y ago

   This plugin is the best out there. I use it every time I have a client that needs to have access to the backend. I can easily make changes to permissions for every user role. 10 stars guys

   Read on wp.org ↗
4. ★★★★★ tomo55555

   2.4y ago

   When we started using this plugin a year or so ago it was good. But now it conflicts with many other plugins and misses out plugins like WPCode. It actually locked me out of the plugin as an administrator, so I had to uninstall AAM.It is a shame because it was once a great plugin.

   Read on wp.org ↗
5. ★★★★★ superwpml

   2.6y ago

   I am looking to hide “metaboxes” in Gutenberg editors, but as far as I understand in the “Metaboxes and Widgets”, in the “Articles” section, when I click hide (Comments, Slug…) .it does nothing.Does it only work in classic editor ?

   Read on wp.org ↗
6. ★★★★★ adamr001

   2.7y ago

   Very comprehensive plugin that was able to do a lot of the things that I needed (especially in comparison to other ones out there when it comes to access management). Support was prompt, professional and very helpful and actually went above and beyond to help me out even after I had misunderstood some of the terms and conditions. They really know their stuff when it comes to WP so you are in good hands!

   Read on wp.org ↗
7. ★★★★★ rosalvoalc

   2.8y ago

   Olá Equipe do Advance Access Manager, Gostaria de expressar minha imensa satisfação com o AAM! Minha experiência com este plugin tem sido excelente, proporcionando um gerenciamento detalhado de usuários e acessos de forma intuitiva e fácil de compreender. O AAM se destaca como o melhor plugin que já encontrei até hoje para lidar com as nuances do controle de usuários e permissões. A interface é amigável, facilitando a configuração e administração das permissões de acesso, tornando todo o processo extremamente eficiente. Agradeço à equipe do Advance Access Manager pelo desenvolvimento de uma ferramenta tão poderosa e eficaz. Continuem o excelente trabalho!

   Read on wp.org ↗
8. ★★★★★ dotboy

   3.0y ago

   Really the quickest and best support I’ve had for any software, ever. Marvellous!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.1.2 Fixed: “Sorry, you are not allowed to give users that role.” when Multi-Role Support is enabled and default_role is not in get_editable_roles() https://github.com/aamplugin/advanced-access-manager/issues/501 Fixed: Incor 7.1.2
2. — Version 7.1.1 Fixed: Incorrectly handled URL with encoded characters https://github.com/aamplugin/advanced-access-manager/issues/500 Fixed: Deprecated: Method ReflectionProperty::setAccessible() is deprecated since 8.5, as it has no e 7.1.1
3. — Version 7.1.0 Fixed: Warning: Undefined array key “effect” in /../application/Framework/Utility/Misc.php on line 483 https://github.com/aamplugin/advanced-access-manager/issues/497 Fixed: Can’t reset ConfigPress https://github.com/aam 7.1.0
4. — Version 7.0.11 Fixed: Advanced Multi-Role setup fails to hide posts https://github.com/aamplugin/advanced-access-manager/issues/491 Fixed: Security Audit References are incorrectly displayed after page refresh https://github.com/aamplu 7.0.11
5. — Version 7.0.10 Fixed: Permalink has empty href when post is password protected https://github.com/aamplugin/advanced-access-manager/issues/487 Fixed: Roles & Capabilities are not syncing in multisite https://github.com/aamplugin/advanc 7.0.10
6. — Version 7.0.9 Fixed: PHP Parse error in php7.4 https://github.com/aamplugin/advanced-access-manager/issues/482 Fixed: Uncaught OutOfRangeException: Cannot find user by identifier 0 in /../Framework/Utility/AccessLevels.php:198 https:/ 7.0.9

All 12 disclosed vulnerabilities are patched in the current version (8.0.2). Sites still on an older version should update.

1. Patched Medium · 5.3 Advanced Access Manager – Access Governance for WordPress <= 7.1.0 - Missing Authorization ↗
   2026-05-14 CVE-2026-42674 Missing Authorization Affects <= 7.1.0 Patched in 7.1.1
2. Patched Medium · 6.1 Advanced Access Manager <= 6.9.20 - Reflected Cross-Site Scripting ↗
   2024-03-20 CVE-2024-29127 Improper Neutralization of Input During Web Page Generation Affects <= 6.9.20 Patched in 6.9.21
3. Patched Medium · 5.5 Advanced Access Manager <= 6.9.20 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-03-16 CVE-2024-29124 Improper Neutralization of Input During Web Page Generation Affects <= 6.9.20 Patched in 6.9.21
4. Patched Medium · 4.3 Advanced Access Manager <= 6.9.18 - Authenticated (Author+) Open Redirect ↗
   2023-12-27 CVE-2023-51675 URL Redirection to Untrusted Site Affects <= 6.9.18 Patched in 6.9.19
5. Patched Medium · 6.4 Advanced Access Manager <= 6.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2023-12-27 CVE-2023-51674 Improper Neutralization of Input During Web Page Generation Affects <= 6.9.18 Patched in 6.9.19
6. Patched Medium · 6.4 Advanced Access Manager <= 6.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2023-12-26 CVE-2023-50881 Improper Neutralization of Input During Web Page Generation Affects <= 6.9.15 Patched in 6.9.16
7. Patched Medium · 4.8 Advanced Access Manager <= 6.7.9 - Admin+ Stored Cross-Site Scripting ↗
   2021-10-19 CVE-2021-24830 Improper Neutralization of Input During Web Page Generation Affects < 6.8.0 Patched in 6.8.0
8. Patched Medium · 4.3 Advanced Access Manager <= 6.6.1 - Authenticated Information Disclosure ↗
   2020-08-20 CVE-2020-35934 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.6.1 Patched in 6.6.2
9. Patched High · 7.5 Advanced Access Manager <= 6.6.1 - Authenticated Authorization Bypass and Privilege Escalation ↗
   2020-08-14 CVE-2020-35935 Authentication Bypass by Primary Weakness Affects <= 6.6.1 Patched in 6.6.2
10. Patched Critical · 9.8 Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read ↗
    2019-09-09 CVE-2019-25213 Improper Limitation of a Pathname to a Restricted Directory Affects < 5.9.9 Patched in 5.9.9
11. Patched High · 8.8 Advanced Access Manager <= 3.2.1 - Unrestricted AJAX Actions allowing Privilege Escalation ↗
    2016-06-21 Improper Authorization Affects < 3.2.2 Patched in 3.2.2
12. Patched High · 7.2 Advanced Access Manager <= 2.8.2 - Arbitrary File Overwrite ↗
    2014-08-20 CVE-2014-6059 Improper Limitation of a Pathname to a Restricted Directory Affects < 2.8.3 Patched in 2.8.3

Translated into 19 languages, 2 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2019-02-01 90K+ → 100K+ up after 129 days in tier
2. 2018-09-25 80K+ → 90K+ up after 169 days in tier
3. 2018-04-09 70K+ → 80K+ up after 330 days in tier
4. 2017-05-14 60K+ → 70K+ up after 261 days in tier
5. 2016-08-26 50K+ → 60K+ up after 500 days in tier
6. 2015-04-14 40K+ → 50K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Access Governance for WordPress (aka AAM) into a readme, a review or a deck. It updates itself.

Access Governance for WordPress (aka AAM): 100K+ active installs, 4.2★ (420 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/advanced-access-manager