PLUGIN SECURITY
Is Wp User Manager safe?
Registration forms, a frontend login form, user profiles and a member directory for WordPress. Add Stripe payments and content restriction.
What this plugin does
- Slug:
wp-user-manager - Author: WP User Manager
- 10000+ active installs
- 94/100 rating (350 reviews on wordpress.org)
- 771707 all-time downloads
- On WordPress.org since 2015-07-06
login formmember directorymembershipregistration formuser profile
Maintenance status
- Latest known version: 2.9.18
- Last updated: 2026-10-20 7:49pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.4+
Known vulnerabilities
16 known CVEs on file for Wp User Manager. Reported between 2021 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-110523 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] >= 2.9.21 - < 2.9.26 | Improper Privilege Management | Unknown | 2.9.21–2.9.26 | 2.9.26 | 2026-10-20 | ⚠ update needed |
| CVE-2026-112823 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.26 | — | Medium 4.3 | < 2.9.26 | 2.9.26 | 2026-10-19 | ⚠ update needed |
| CVE-2026-110527 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] >= 2.9 - < 2.9.20 | Improper Access Control | Unknown | 2.9–2.9.20 | 2.9.20 | 2026-10-17 | ⚠ update needed |
| CVE-2026-108496 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.24 | — | Medium 5.3 | < 2.9.24 | 2.9.24 | 2026-10-12 | ⚠ update needed |
| CVE-2026-107423 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.23 | — | Medium 4.3 | < 2.9.23 | 2.9.23 | 2026-10-03 | ⚠ update needed |
| CVE-2026-103085 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.21 | — | Medium 6.5 | < 2.9.21 | 2.9.21 | 2026-09-22 | ⚠ update needed |
| CVE-2026-94079 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.20 | Missing Authorization | Medium 5.3 | < 2.9.20 | 2.9.20 | 2026-09-21 | ⚠ update needed |
| CVE-2026-9290 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 2.9.18 | 2.9.18 | 2026-06-05 | ✓ fixed in latest |
+ 8 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-49766 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Critical 9.9 | < 2.9.17 | 2.9.17 | 2026-06-05 | ✓ fixed in latest |
| CVE-2026-18345 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.19 | Missing Authorization | Medium 4.3 | < 2.9.19 | 2.9.19 | 2026-06-05 | ⚠ update needed |
| CVE-2025-13320 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.13 | External Control of File Name or Path | Medium 6.8 | < 2.9.13 | 2.9.13 | 2025-12-11 | ✓ fixed in latest |
| CVE-2025-60245 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.13 | Deserialization of Untrusted Data | Critical 9.8 | < 2.9.13 | 2.9.13 | 2025-05-19 | ✓ fixed in latest |
| CVE-2024-10216 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.12 | Missing Authorization | Medium 4.3 | < 2.9.12 | 2.9.12 | 2024-11-22 | ✓ fixed in latest |
| CVE-2024-10537 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.12 | Missing Authorization | Medium 4.3 | < 2.9.12 | 2.9.12 | 2024-11-22 | ✓ fixed in latest |
| CVE-2024-43336 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.9.11 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 2.9.11 | 2.9.11 | 2024-08-16 | ✓ fixed in latest |
| CVE-2021-24655 | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager] < 2.6.3 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 2.6.3 | 2.6.3 | 2021-09-22 | ✓ fixed in latest |
How to fix it
Keep Wp User Manager updated — 2.9.18 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Custom Login Page Customizer — 50000+ active installs — 98/100 (476) — max PHP 8.4
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP — 20000+ active installs — 94/100 (183) — max PHP <8.0
- Business Directory Plugin – Easy Listing & Member Directories for WordPress — 10000+ active installs — 92/100 (504) — max PHP 8.4
- Pie Register – User Registration, Profiles & Content Restriction — 1000+ active installs — 84/100 (222)
- Login Page Customizer – Customize Login Screen & Branding — 1000+ active installs — 64/100 (5)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.