Skip to content
PluginCanary

WP-Members Membership Plugin

by Chad Butler · 50,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (40 of 100).

79/ 100 Canary Score
Sub-scores for WP-Members Membership Plugin
Ownership100
Maintenance100
Security60
Support40
Reputation85

How the score works

Quick answers

Is WP-Members Membership Plugin still maintained?
Yes. Last release 27 Oct 2026, 18 releases in the last 24 months. 27 Oct 2026 · wordpress.org
Who owns WP-Members Membership Plugin, and has it changed hands?
No change recorded. Main committer cbutlerjr since Sep 2009. 4 Nov 2026 · SVN log
Was WP-Members Membership Plugin removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is WP-Members Membership Plugin safe?
21 known vulnerabilities, all fixed (latest in 3.5.8). Not on the exploited list. 12 Oct 2026 · Wordfence Intelligence
Is the latest WP-Members Membership Plugin update safe to install?
No ownership change before 3.5.8.3. No one-star spike after it. 27 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
cbutlerjr23 Sep 2009 to 27 Oct 2026, 603 commits

1 committer recorded. No ownership change since 2007.

Maintenance

Last release
8 days ago
Releases, 24 months
18
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for WP-Members Membership Plugin
Q1 20242
Q2 20243
Q3 20240
Q4 202412
Q1 20253
Q2 20253
Q3 20252
Q4 20252
Q1 20263
Q2 20260
Q3 20261
Q4 20264

Last release 27 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (1 review). Lifetime: 4.6.

Average rating per quarter for WP-Members Membership Plugin
Q4 20235.0
Q1 20245.0
Q2 20245.0
Q3 20245.0
Q4 20244.0
Q1 20255.0
Q2 20253.7
Q3 20253.3
Q4 20255.0
Q2 20265.0
Q3 20265.0

Average rating stayed at 5.0 between Q4 2023 and Q3 2026.

Rating distribution
5 star234
4 star11
3 star7
2 star3
1 star17
Latest low reviews

Security record

10 vulnerabilities in 24 months (21 on record), all patched (latest fixed in 3.5.8).

Show 21 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
12 Oct 2026WP-Members Membership Plugin <= 3.5.7 - Missing Authorization4.3<= 3.5.73.5.86
10 Sep 2026WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting6.1<= 3.5.63.5.7Patched before disclosure
3 Mar 2026WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute6.5<= 3.5.5.13.5.6Patched before disclosure
14 Jan 2026WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields5.4<= 3.5.4.33.5.4.4Patched before disclosure
6 Jan 2026WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files5.3<= 3.5.4.43.5.4.5Patched before disclosure
22 Sep 2025WP-Members <= 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.5.4.23.5.4.3Patched before disclosure
8 Sep 2025WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names5<= 3.5.4.23.5.4.3Patched before disclosure
21 Jul 2025WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.5.4.13.5.4.21
19 Jun 2025WP-Members <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.5.43.5.4.14
16 May 2025WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode6.4<= 3.5.23.5.312
24 Oct 2024WP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode6.4<= 3.4.9.53.4.9.6Patched before disclosure
21 Oct 2024WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting6.1<= 3.4.9.53.4.9.6Patched before disclosure
25 Apr 2024WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files5.3<= 3.4.9.33.4.9.4Patched before disclosure
1 Apr 2024WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.4.9.23.4.9.319
7 Mar 2024WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 3.4.9.13.4.9.21
3 Jan 2024WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure6.5<= 3.4.83.4.9Patched before disclosure
22 Jun 2023WP-Members Membership <= 3.4.7.3 - Cross-Site Request Forgery to Settings Update4.3<= 3.4.7.33.4.842
8 Jun 2023WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update4.3<= 3.4.7.33.4.856
13 Jun 2019WP-Members <= 3.2.7 - Cross-Site Request Forgery8.8<= 3.2.73.2.8.1n/a
13 Jun 2017WP-Members < 3.1.8 - Cross-Site Scripting6.1< 3.1.83.1.8722
7 Jan 2014WP-Members Membership Plugin <= 2.8.9 - Reflected Cross-Site Scripting7.1< 2.8.102.8.10828

Changelog mentions of security fixes: 3.5.7 (security); 3.5.8 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

40% of 5 support threads resolved in the last 2 months.

Momentum

50,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP-Members Membership Plugin
4 May 2026463
11 May 20261,426
18 May 20261,305
25 May 20261,383
1 Jun 20261,100
8 Jun 20261,057
15 Jun 20261,001
22 Jun 2026987
29 Jun 2026948
6 Jul 2026926
13 Jul 2026966
20 Jul 20261,153
27 Jul 20261,011
3 Aug 20261,107
10 Aug 2026920
17 Aug 2026972
24 Aug 2026970
31 Aug 20261,000
7 Sep 202621,053
14 Sep 20264,674
21 Sep 20263,404
28 Sep 20262,488
5 Oct 20262,268
12 Oct 20262,115
19 Oct 202641,595
26 Oct 202624,784
2 Nov 2026968

Weekly downloads over the last 4 weeks are 284% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Simple Membership After LoginScore 100 · 10,000+Restricted Site AccessScore 98 · 10,000+Restrict User AccessScore 96 · 10,000+Content ControlScore 95 · 40,000+Force LoginScore 95 · 30,000+

Facts

Version3.5.8.3
AuthorChad Butler
Added23 Sep 2009
Last updated27 Oct 2026
Active installs50,000+
Requires WordPress5.9
Tested up to7.1.4
Requires PHPnot stated
CategoryCommunity & Social > Membership Sites & Subscriptions
Tagslogin, membership, Restriction, registration, authentication

Other plugins by this author: WordPass

Questions

Is WP-Members Membership Plugin still maintained?

Yes. Last release 27 Oct 2026, 18 releases in the last 24 months.

Who owns WP-Members Membership Plugin, and has it changed hands?

No change recorded. Main committer cbutlerjr since Sep 2009.

Was WP-Members Membership Plugin removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is WP-Members Membership Plugin safe?

21 known vulnerabilities, all fixed (latest in 3.5.8). Not on the exploited list.

Is the latest WP-Members Membership Plugin update safe to install?

No ownership change before 3.5.8.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue