Changelog

2.9.18 (30th May 2026)

• Security: Hardened profile tab input validation (thanks to Yat via Wordfence for responsible disclosure)
• Fix: Custom avatar not shown when a default avatar is also configured
• Fix: Multiple roles not saving on the admin edit user page
• Fix: Email content editor for ‘Delete Inactive Accounts’ not working with block themes

2.9.17 (11th May 2026)

• Security: Hardened file field input validation during registration (thanks to endy via Patchstack for responsible disclosure)

2.9.16 (11th Apr 2026)

• Fix: PHP 8.2+ dynamic property deprecation warnings in WPUM_Field
• Fix: Account update no longer fails when avatar or cover image file is missing from disk
• Fix: Password recovery now works when the username is an email address different from the stored email
• Fix: Multicheckbox and multiselect fields no longer cause errors when the stored value is not an array

2.9.15 (26th Feb 2026)

• Fix: User role multiselect was disabled on the admin user profile after Carbon Fields upgrade

2.9.14 (24th Feb 2026)

• Improvement: Updated Brain\Cortex routing library for PHP 8.3 compatibility
• Improvement: Upgraded Carbon Fields to a version compatible with PHP 8.1-8.3
• Fix: Translation loading now uses the correct hook for WordPress 6.7+ compatibility
• Improvement: Minimum PHP version raised from 7.2 to 7.4

2.9.13 (16th Dec 2025)

• Security: Fixed authenticated arbitrary file deletion vulnerability in custom avatar and cover image handling (Thanks to YC_Infosec via Wordfence)
• Security: Fixed a PHP Object Injection vulnerability in the user nickname profile field (Thanks to Nguyen Ngoc Quang Bach (maysbachs) via Patchstack)

2.9.12 (21st Nov 2024)

• Security: Missing authorization to authenticated check for the unique usermeta key check when editing a field (Thanks to Tieu Pham Trong Nhan)
• Security: Carbon Field sidebar AJAX action handlers removed which are not used but posed a CSRF security risk (Thanks to BrokenAC)

2.9.11 (7th Sept 2024)

• Security: Nonce check added to the admin action of fixing old plugin data

2.9.10 (2nd April 2024)

• Improvement: + and other characters no longer accepted in username at registration
• Fix: Required checkboxes field hidden with conditional logic incorrectly requires all boxes to be checked
• Fix: Registration form duplicate id attribute HTML issues
• Tested with WordPress 6.5

2.9.9 (11th March 2024)

• Fix: Stripe subscriptions not connecting to user correctly
• Fix: Password field not allowing special characters

2.9.8 (19th November 2023)

• Fix: Unable to add new WPUM Blocks or edit existing ones
• Fix: PHP 8.1 and 8.2 notices
• Fix: Redirect loop when preventing access to the site unless logged in for sites installed in a subdirectory
• Fix: Unable to submit WPUM forms as Elementor widgets
• Fix: Displayed Stripe product prices incorrectly rounded to whole numbers
• Fix: REST API endpoints not accessible when preventing access to the site unless logged in
• Fix: Unable to remove all “Allowed Roles” in the custom field permissions tab
• Fix: Unable to add blocks for the Likes, Private Content, and Social Login addons
• Fix: Unable to delete custom role

2.9.7 (23rd March 2023)

• Fix: WP User Manager custom blocks and block restriction settings now appear in the block editor

2.9.6 (22nd March 2023)

• Improvement: Plugin now requires PHP 7.2+
• Fix: PHP Fatal error: Cannot declare because the name is already in use in
• Fix: Date picker on the account page now uses the correct display format

2.9.5 (17th March 2023)

• Fix: PHP Fatal error: Uncaught Error: Class ‘WPUM\Walker_Nav_Menu_Edit’ not found
• Fix: Date picker not saving in correct format
• Fix: Repeater fields not loading correctly

2.9.4 (17th March 2023)

• Fix: Fatal error: Cannot declare because the name is already in use in errors

2.9.3 (16th March 2023)

• Fix: Fatal errors on sites using Divi

2.9.2 (16th March 2023)

• Fix: PHP 8 Fatal error: Uncaught TypeError: spl_autoload_unregister(): Argument #1 ($callback) must be a valid callback

2.9.1 (16th March 2023)

• Fix: PHP Fatal error failed opening required /includes/functions-scoped.php

2.9 (16th March 2023)

• New: Collect payment for site access with credit cards using our Stripe integration
• New: Use native Elementor widgets instead of WP User Manager shortcodes
• New: Choose an image as the default avatar for users who haven’t uploaded one
• New: Compatibility with the Stripe Pro addon
• Improvement: Registration success notice now shows on after registration redirect pages
• Improvement: Third-party dependency code is now prefixed to avoid clashes with other plugins
• Improvement: Storage date format for the Date picker field updated to ‘Y-m-d’ for standardization
• Improvement: Date format for the Date picker field can be altered with the ‘wpum_field_datepicker_date_format’ filter
• Fix: PHP notice on form submit with Repeater field with conditional logic

2.8.19 (3rd February 2023)

• Improvement: Pagination for comments on the profile, with comments per page setting
• Fix: Email customizer now works with the OceanWP theme
• Fix: Conditional logic support for Repeater subfields

2.8.18 (23rd January 2023)

• Fix: Code fixes using PHPStan (props szepeviktor)
• Fix: Renaming a registration form now works correctly
• Fix: Abort loading plugin early if plugin doesn’t meet PHP or WP requirements
• Fix: Newsletter email form on welcome page updated
• Fix: Formatting on the welcome page
• Fix: Updated documentation URLs

2.8.17 (18th January 2023)

• New: Setting to partially obfuscate email addresses used as the user display name
• Improvement: ‘wpum_authentication_method_admin_override’ filter to enforce admin logins with the correct username/email method
• Fix: Headers for field groups with only hidden fields now don’t render on the profile
• Fix: Searching in a directory for users with apostrophes in their names now returns result
• Fix: Redirecting to a URL with query parameters now retains the parameters after login

2.8.16 (2nd January 2023)

• New: Compatibility with Likes addon
• New: Blocks for Social Login Buttons and Private Content
• Improvement: Profile permission settings now in a different tab in the admin
• Fix: User role editor now saving grant and deny capabilities correctly
• Fix: Profile Card block settings now working correctly
• Fix: Undefined offset: 0 in wp-user-manager/includes/actions.php on line 117
• Fix: Error log messages now not showing if a profile is accessed for a user that does not exist

2.8.15 (21st December 2022)

• New: Compatibility with hCaptcha addon
• Fix: Warning: Undefined array key “action” now not showing
• Fix: Undefined offset: 0 when excluding roles from showing the admin bar

2.8.14 (6th December 2022)

• Improvement: Saving a custom field with same unique key is now not allowed
• Improvement: ‘wpum_prevent_entire_site_access_allowed_urls’ filter for allowing URLs when site access is prevented
• Fix: Multiple checkboxes field now saving correctly
• Fix: Existing file fields data in a repeater field are now preserved correctly on save
• Fix: Menu item user role restriction now works as expected
• Fix: Switching back to a user with the User Switching plugin now works as expected
• Fix: Plugin admin scripts now not loading on every admin page
• Fix: Hypens now allowed in unique meta key for custom fields

2.8.13 (19th October 2022)

• Fix: User, User Role, and User Taxonomy fields now saving multiple values correctly

2.8.12 (16th September 2022)

• Fix: Forms in widgets now render correctly
• Fix: Multi select fields now rendered correctly when hidden with conditional logic

2.8.11 (15th September 2022)

• Improvement: Links on the Already Logged In template can be filtered using the ‘wpum_already_logged_in_links’ filter
• Fix: Password reset success message now renders HTML correctly
• Fix: File field now correctly saving uploads
• Fix: Sub pages for the account and profile page now loading when using an Elementor template

2.8.10 (14th September 2022)

• Fix: Conditional logic settings now correctly saving when editing a field
• Fix: Custom field unique meta keys now converted to lowercase to stop fatal errors

2.8.9 (12th September 2022)

• Improvement: Options for dropdown, multiselect, checkbox and radio buttons fields can be pasted in
• Improvement: Plugin coding standards improved
• Fix: Account and profile subpages now correctly styled like the parent page when using page builder plugins
• Fix: PHP notices now not thrown when using conditional logic with empty multiselect fields

2.8.8 (16th August 2022)

• Security: File uploads now checked for matching file extension and file type before attempting to upload
• Fix: HTML in form error messages now showing correctly
• Fix: ‘Edit account’ string on the profile page now localized for translation

2.8.7 (8th August 2022)

• Fix: PHP Notice: Undefined index preventing form submission on some installs

2.8.6 (7th August 2022)

• Improvement: Conditional logic for fields now supported for both the Custom Fields and ACF addons
• Fix: Change Password account form now loading correctly after save
• Fix: Account and profile sub pages now inheriting the parent page template which was broken in WordPress 6.0
• Fix: Saving Divi pages now not throwing fatal errors on some installs
• Fix: Registration form error messages now using the general-error.php template

2.8.5 (25th May 2022)

• Fix: Account and profile sub pages now working with WordPress 6.0

2.8.4 (22nd May 2022)

• Tested with WordPress 6.0
• Fix: Plugin now compatible with sites with object caching enabled

2.8.3 (12th May 2022)

• Fix: Field names with apostrophes now don’t have slashes added
• Fix: Prevent site access now compatible with Social Login addon

2.8.2 (1st May 2022)

• Improvement: Redirect URL after login can now be filtered with ‘wpum_login_redirect_to_url’ filter when restricting content
• Fix: Password reset page now accessible when preventing access to the whole site
• Fix: Email settings tab now only showing for File fields
• Fix: File field help hint now includes jpeg in the example file extensions for clarity
• Fix: WP User Manager addons now showing as tested up to the minor WordPress versions correctly

2.8.1 (25th February 2022)

• Fix: User password now not regenerated when other plugins create users when using a ‘password’ field
• Fix: WP CLI commands now working when the site is locked

2.8 (24th February 2022)

• New: Sites can now be completely locked from access unless users are logged in
• New: Email sent to the site administrator when a new user registers can now be customized like other emails from the email screen
• New: File fields can now be attached to new user registration emails with the Custom Fields addon
• New: Emails can now be disabled from the email screen
• New: Directory sorting option is now filterable with ‘wpum_directory_sort_options’ to allow setting custom sort field
• Improvement: User is now alerted if they have unsaved field settings and try to change settings tabs
• Fix: ‘Username or email’ string now used to match WordPress and leverage existing string translations

Earlier versions

For the full changelog with earlier versions, please refer to the changelog on wpusermanager.com.