Skip to content
PluginCanary

WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory

by WP User Manager · 10,000+ active installs · Checked 3 Nov 2026
Healthy9 Warnings

Healthy: vulnerability published 29 Oct 2026, fixed in 2.10.0.

81/ 100 Canary Score
Sub-scores for WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 29 Oct 2026, fixed in 2.10.0. Update to version 2.10.0 or later.29 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 20 Oct 2026, fixed in 2.9.26. Update to version 2.9.26 or later.20 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 19 Oct 2026, fixed in 2.9.26. Update to version 2.9.26 or later.19 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 2.9.20. Update to version 2.9.20 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 13 Oct 2026, fixed in 2.9.24. Update to version 2.9.24 or later.13 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 12 Oct 2026, fixed in 2.9.23. Update to version 2.9.23 or later.12 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 3 Oct 2026, fixed in 2.9.21. Update to version 2.9.21 or later.3 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 22 Sep 2026, fixed in 2.9.20. Update to version 2.9.20 or later.22 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 2.9.19. Update to version 2.9.19 or later.21 Sep 2026Evidence
  • InfoSEC-315 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
alessandro.tesoro6 Jul 2015 to 18 Aug 2019, 290 commits
wpusermanager27 Sep 2019 to 1 Nov 2026, 139 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
3 days ago
Releases, 24 months
21
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory
Q1 20241
Q2 20241
Q3 20241
Q4 20241
Q1 20250
Q2 20250
Q3 20250
Q4 20251
Q1 20262
Q2 20263
Q3 20263
Q4 202611

Last release 1 Nov 2026. Tested with WordPress 7.1 (current).

Support

100% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
29 Oct 2026WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Missing Authorization5.3<= 2.9.262.10.00
20 Oct 2026WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.25 - Missing Authorization4.3<= 2.9.252.9.260
19 Oct 2026User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation7.32.9.21 to 2.9.252.9.260
15 Oct 2026User Manager 2.9 - 2.9.19 - Unauthenticated Payment Bypass5.32.9 to 2.9.192.9.200
13 Oct 2026WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.23 - Missing Authorization5.3<= 2.9.232.9.240
12 Oct 2026WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Missing Authorization4.3<= 2.9.222.9.230
3 Oct 2026WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.20 - Unauthenticated Privilege Escalation7.3<= 2.9.202.9.210
22 Sep 2026WP User Manager – User Profile Builder & Membership <= 2.9.19 - Missing Authorization5.3<= 2.9.192.9.200
21 Sep 2026WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback4.3<= 2.9.182.9.190
5 Jun 2026WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion8.1<= 2.9.162.9.170
5 Jun 2026WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter7.5<= 2.9.172.9.180
11 Dec 2025WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter6.8<= 2.9.122.9.135
19 May 2025User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection7.5<= 2.9.122.9.13211
22 Nov 2024WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal4.3<= 2.9.112.9.120
22 Nov 2024WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration4.3<= 2.9.112.9.120
16 Aug 2024WP User Manager <= 2.9.10 - Cross-Site Request Forgery4.3<= 2.9.102.9.1123
22 Sep 2021WP User Manager <= 2.6.2 - Arbitrary User Password Reset7.5<= 2.6.22.6.30
6 Sep 2021User Registration < 2.0.2 - Authenticated Stored Cross-Site Scripting5.4< 2.0.22.0.20

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.7 from 350 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star299
4 star29
3 star9
2 star1
1 star12

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory
4 May 2026435
11 May 20265,933
18 May 20261,904
25 May 20265,217
1 Jun 20262,740
8 Jun 20261,726
15 Jun 2026912
22 Jun 2026700
29 Jun 2026686
6 Jul 20261,149
13 Jul 2026697
20 Jul 2026615
27 Jul 2026652
3 Aug 2026600
10 Aug 2026587
17 Aug 2026557
24 Aug 2026543
31 Aug 2026600
7 Sep 2026543
14 Sep 20264,950
21 Sep 20263,449
28 Sep 202610,282
5 Oct 20266,989
12 Oct 202611,530
19 Oct 20267,528
26 Oct 202617,763
2 Nov 20261,835

Weekly downloads over the last 4 weeks are 186% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LoginWP (Formerly Peter's Login Redirect)Score 92 · 80,000+Gravatar Enhanced - Avatars, Profiles, and PrivacyScore 91 · 100,000+WP User AvatarsScore 91 · 20,000+Sidebar LoginScore 91 · 9,000+WP Login FormScore 91 · 7,000+

Facts

Version2.10.5
AuthorWP User Manager
Added6 Jul 2015
Last updated1 Nov 2026
Active installs10,000+
Requires WordPress4.9
Tested up to7.1.4
Requires PHP7.4
CategoryCommunity & Social > Membership Sites & Subscriptions
Tagslogin form, membership, user profile, member directory, registration form

Other plugins by this author: Smart Archive Page Remove, Smart User Slug Hider, Smart Attachment Page Remove, Smart Custom Display Name, WP User Manager Newsletter, WP User Manager Username Length

Questions

Is WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory still maintained?

WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory was last updated on 1 Nov 2026. Its Canary status is Healthy.

Is WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory safe?

WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory has no open unpatched vulnerabilities on record. 15 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory?

The wordpress.org author is WP User Manager. Recent committers: wpusermanager, alessandro.tesoro, plugin-master. We have recorded no ownership change.

What can I use instead of WP User Manager - Registration Form, Login Form, User Profile Builder & Member Directory?

Plugins in the same category with a higher Canary Score: LoginWP (Formerly Peter's Login Redirect), Gravatar Enhanced - Avatars, Profiles, and Privacy, WP User Avatars, Sidebar Login, WP Login Form.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue