WP User Manager – User Profile Builder & Membership

2.9.18 (30th May 2026)

Security: Hardened profile tab input validation (thanks to Yat via Wordfence for responsible disclosure)

Fix: Custom avatar not shown when a default avatar is also configured

Fix: Multiple roles not saving on the admin edit user page

Fix: Email content editor for ‘Delete Inactive Accounts’ not working with block themes

2.9.17 (11th May 2026)

Security: Hardened file field input validation during registration (thanks to endy via Patchstack for responsible disclosure)

2.9.16 (11th Apr 2026)

Fix: PHP 8.2+ dynamic property deprecation warnings in WPUM_Field

Fix: Account update no longer fails when avatar or cover image file is missing from disk

Fix: Password recovery now works when the username is an email address different from the stored email

Fix: Multicheckbox and multiselect fields no longer cause errors when the stored value is not an array

2.9.15 (26th Feb 2026)

Fix: User role multiselect was disabled on the admin user profile after Carbon Fields upgrade

2.9.14 (24th Feb 2026)

Improvement: Updated Brain\Cortex routing library for PHP 8.3 compatibility

Improvement: Upgraded Carbon Fields to a version compatible with PHP 8.1-8.3

Fix: Translation loading now uses the correct hook for WordPress 6.7+ compatibility

Improvement: Minimum PHP version raised from 7.2 to 7.4

2.9.13 (16th Dec 2025)

Security: Fixed authenticated arbitrary file deletion vulnerability in custom avatar and cover image handling (Thanks to YC_Infosec via Wordfence)