Ultimate Member WooCommerce 2.14.0

Improved

• Enhancements:
  • Added: Fallback for wp-cli/wp-config-transformer library if the wp-config.php file isn't writable.
  • Added: Filter hook um_members_directory_filter_text 3rd parameter $is_default to check if it's admin filtering or frontend query.
  • Added: 'Administrative capabilities ban' option enabled by default after the first installation.
  • Optimized: Slow SQL query for batch empty account status check.
  • Optimized: Set the recurring action for account status check as unique.
  • Optimized: Redundant SQL calls when editing Profile page with callback dropdowns. Cached usermeta existence checks per user and key during a single load (Reported by @MissVeronica, author @faisalahammad).
• Deprecated:
  • Deprecated: Filter hook um_members_directory_filter_text_meta_value is fully deprecated, replacement isn't required for the text-type filter field.

Other

• Bugfixes:
  • Fixed: Security issue related to an unauthenticated visitor can store JavaScript that runs in an administrator's session, through their own profile name. (Reported by Karthik Ramakrishnan and WPScan team). Fixed um_convert_tags() function and applied the escapers throughout the placeholder replacement.
  • Fixed: Using LIKE compare for the text-type filters with custom usermeta table (Reported by @MissVeronica, author @faisalahammad).
  • Fixed: "Can user edit this field?" field setting displaying only for the User Profile form fields.
  • Fixed: Getting the pages list in the wp-admin UM > Settings > General > Pages section.
  • Fixed: Displaying the field-type time on the User Profile page.
  • Fixed: Using illegal_user_logins for current admin user with the username specified in the illegal user logins list.

Improved

• Enhancements:
  • Added: Using illegal_user_logins filter to sanitize the user_login field value during registration or upgrade.
  • Added: Using wp-cli/wp-config-transformer library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
  • Added: New user-capabilities functions UM()->common()->users()->can_view_user(), UM()->common()->users()->get_privacy_setting(), UM()->common()->users()->is_user_profile_private(), UM()->common()->users()->get_restricted_privacy_notice(), UM()->common()->users()->can_view_private_user_profile(), UM()->common()->users()->can_view_user_profile(). The future replacement for the um_can_view_profile() helper with different cases to check.
  • Updated: Version of the WordPress native excluded functions to avoid the using them in the callbacks.
• Templates Requiring Update:
  • gdpr-register.php
  • profile.php
• Deprecated:
  • Deprecated: Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native <input type="date" /> and <input type="time" /> instead.
• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade

Other

• Bugfixes:
  • Fixed: WP_Filesystem() initialization optimization. Init WP_Filesystem() only once when it's necessary.
  • Fixed: Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
  • Fixed: Registration form infinite loop – gdpr-register.php calls the_content recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
  • Fixed: Causes site-wide rest_cookie_invalid_nonce on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized um_admin_scripts.nonce globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
  • Fixed: Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
  • Fixed: Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
  • Fixed: Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
  • Fixed: Member Directory type-button styles.
  • Fixed: Added fallback for the date and time fields to show date and time using the WordPress native format.

Improved

• Enhancements:
  • Added: Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value.
  • Added: The API key field type for the settings fields.
• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade

Other

• Bugfixes:
  • Fixed: Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information).
  • Fixed: Security issue when accidentally manage_options level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar).
  • Fixed: Set <iframe> size proportions during responsive handlers.
  • Fixed: mousewheel action during member directory loading and overlay is displayed.
  • Fixed: WP_Styles notice due to not loaded um_modal styles.
  • Fixed: oEmbed-type field styles.

Improved

• Deprecated:
  • Temporary deprecated: UM REST API. Legacy feature that has to be refactored. Will be refactored and re-released soon.

Other

• Bugfixes:
  • Fixed: Security issue, CVE ID: CVE-2026-7761.
  • Restricted get_directory_by_hash() function to only match posts with post_type='um_directory' and publish post status.
  • Used 0 === strpos() instead of strstr() for getting proper post_data.
  • Added condition for getting only allowed fields in tagline_fields and reveal_fields to build_user_card_data().
  • Fixed: Security issue, CVE ID: CVE-2026-8489.
  • Used WordPress native wp_kses() escaper for displaying user_description field. Used WordPress native make_clickable() function to make raw links clickable.
  • Fixed: Security issue, CVE ID: CVE-2026-xxxx. Make the role and status visible for the user who can edit these users in the request. Reported by [Ben Tamam](bentamam.github.io).
  • Fixed: Remove UM option function when the option value equals "0".

Improved

• Enhancements:
  • Added: Checking format of the 3rd-party registered custom fields. Avoid PHP errors related to the wrong format or unexpected attributes.
• Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade

Other

• Bugfixes:
  • Fixed: Added uploader fields accept argument for set allowed mime-types in the upload dialog window. Updated 3.1.2 version of this library hayageek/jquery-upload-file. Don't use 4.0.11 version for now.
  • Fixed: JS initialization of the empty uploader fields.
  • Fixed: User Profile URLs in the User Profile form on the not-predefined pages placed via shortcode.