WP User Manager – User Profile Builder & Membership

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 93% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ gbacc

   4mo ago

   The Mailchimp add-on doesn’t work and they have terrible support!!!

   Read on wp.org ↗
2. ★★★★★ fevzi08

   5mo ago

   Bazı eksikleri olsa da işimi görüyor.

   Read on wp.org ↗
3. ★★★★★ brendar

   6mo ago

   After all the time & effort I’ve spent setting up the back-end of wpum, when I did a test registration, I can’t go through, it’s giving me an error message of, ” – is a required field.” After investigating, I found out that Username, Nickname and Display names are required fields by default; even if you don’t use them in your registration form. There is no way to edit this unless you pay $69. per year for the Custom Fields add-on. I could pay it but I felt cheated and tricked so I just used Ultimate Member. No modern registration form requires Username, Nickname and Display name all at once, and the free version gives you no way to disable them.

   Read on wp.org ↗
4. ★★★★★ bigjon2026

   7mo ago

   If you want this system you do you. if you want to change it ever so slightly, or more, you will end up pulling your hair out and having a broken site. this thing uses templates – block editor (wp, hosts, elementor, etc) NOT ALLOWED. Also cant change redirects. email confirmation is automatic – no ‘click link to confirm’, If you use the normal Appearance – Editor – Navigation, it will all go wrong, the hiding of menu items doesnt work properly… There are so many quirks that after hours im giving up.

   Read on wp.org ↗
5. ★★★★★ Earl_D

   11mo ago

   I have looked at many plugins for user management and membership over the years. My criteria was easy to use and set up for extensible features. Based on that this is the best one I have found so far.

   Read on wp.org ↗
6. ★★★★★ Gabriel Ofei

   11mo ago

   I have had several problems on my site. Never logging out . Having to press the login several times. Sometimes locking me out of my site. I blamed it on other plugins until today I rang my host’s they checked the servers and said wp user manager was the problem. They deleted it and now everything is fine quite shocking as I thought it was a wordpress plugin. So be careful of this plugin.

   Read on wp.org ↗
7. ★★★★★ vtchevalier

   1.1y ago

   Works as expected.

   Read on wp.org ↗
8. ★★★★★ vissersj

   1.2y ago

   Very useful plugin and great support by Robert!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.9.18 Security: Hardened profile tab input validation (thanks to Yat via Wordfence for responsible disclosure) Fix: Custom avatar not shown when a default avatar is also configured Fix: Multiple roles not saving on the admin e 2.9.18
2. — Version 2.9.17 Security: Hardened file field input validation during registration (thanks to endy via Patchstack for responsible disclosure) 2.9.17
3. — Version 2.9.16 Fix: PHP 8.2+ dynamic property deprecation warnings in WPUM_Field Fix: Account update no longer fails when avatar or cover image file is missing from disk Fix: Password recovery now works when the username is an email ad 2.9.16
4. — Version 2.9.15 Fix: User role multiselect was disabled on the admin user profile after Carbon Fields upgrade 2.9.15
5. — Version 2.9.14 Improvement: Updated Brain\Cortex routing library for PHP 8.3 compatibility Improvement: Upgraded Carbon Fields to a version compatible with PHP 8.1-8.3 Fix: Translation loading now uses the correct hook for WordPress 6. 2.9.14
6. — Version 2.9.13 Security: Fixed authenticated arbitrary file deletion vulnerability in custom avatar and cover image handling (Thanks to YC_Infosec via Wordfence) Security: Fixed a PHP Object Injection vulnerability in the user nickname 2.9.13

9 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.5 WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter ↗
   2026-06-05 CVE-2026-9290 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.9.17 Patched in 2.9.18
2. High · 8.1 WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion ↗
   2026-06-05 CVE-2026-49766 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.9.16 Patched in 2.9.17
3. Medium · 6.8 WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter ↗
   2025-12-11 CVE-2025-13320 External Control of File Name or Path Affects <= 2.9.12 Patched in 2.9.13
4. High · 7.5 User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection ↗
   2025-05-19 CVE-2025-60245 Deserialization of Untrusted Data Affects <= 2.9.12 Patched in 2.9.13
5. Medium · 4.3 WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal ↗
   2024-11-22 CVE-2024-10216 Missing Authorization Affects <= 2.9.11 Patched in 2.9.12
6. Medium · 4.3 WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration ↗
   2024-11-22 CVE-2024-10537 Missing Authorization Affects <= 2.9.11 Patched in 2.9.12
7. Medium · 4.3 WP User Manager <= 2.9.10 - Cross-Site Request Forgery ↗
   2024-08-16 CVE-2024-43336 Cross-Site Request Forgery (CSRF) Affects <= 2.9.10 Patched in 2.9.11
8. High · 7.5 WP User Manager <= 2.6.2 - Arbitrary User Password Reset ↗
   2021-09-22 CVE-2021-24655 Authorization Bypass Through User-Controlled Key Affects <= 2.6.2 Patched in 2.6.3
9. Medium · 5.4 User Registration < 2.0.2 - Authenticated Stored Cross-Site Scripting ↗
   2021-09-06 CVE-2021-24654 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.0.2 Patched in 2.0.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 25 languages, 8 at 90% or more

Plus 1 more locale with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 200K+ installs · 4.4★ · 4 shared tags A
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress 100K+ installs · 3.1★ · 3 shared tags B
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 50K+ installs · 4.8★ · 3 shared tags A
• U Ultimate Member – reCAPTCHA 20K+ installs · 3.8★ · 3 shared tags C
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 20K+ installs · 4.1★ · 3 shared tags A
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress 5K+ installs · 4.8★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for WP User Manager – User Profile Builder & Membership into a readme, a review or a deck. It updates itself.

WP User Manager – User Profile Builder & Membership: 10K+ active installs, 4.7★ (350 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wp-user-manager