Advanced Access Manager – Access Governance for WordPress

82 Quality Score

Active Installs

23/30

With 100,000 active installs it is a mid-tier plugin, well known in the access control niche but far behind the top security plugins that clear 1 million installs.

Update Freshness

25/25

Last updated on 2026-05-25, the maintenance score is perfect, signalling an actively developed plugin that keeps pace with WordPress core releases.

User Rating

13/15

A rating of 84 out of 100 from 420 reviewers is solid and indicates most users feel the plugin delivers on its promises, though the smaller review pool means feedback is less battle-tested than category leaders.

Support Health

8/15

Only 3 total support threads with 0 resolved is a real weakness; the sample size is small but the 0.0 percent resolution rate suggests either low community engagement or that users self-support through documentation.

WP Compatibility

15/15

Tested with WordPress 7.0.0 and requiring PHP 5.6.0 with a WordPress minimum of 5.8.0, compatibility is excellent and the plugin runs on virtually every modern WordPress environment.

Scores higher than 89% of indexed plugins

About

Access Governance for WordPress. Control roles, users, content, admin areas, and APIs to prevent broken access controls and excessive privileges.

Active Installs 100k+

Rating ★★★★ 4.2/5

Last Updated 2026-09-08 10:26am GMT

Requires WordPress 5.8.0+

Tested Up To 7.1.0

Requires PHP 5.6.0+

Security History

12 known vulnerabilities, all patched

1 Critical 3 High 8 Medium

Most recent: May 14, 2026

View details ▸

Advanced Access Manager – Access Governance for WordPress <= 7.1.0 - Missing Authorization Medium

May 14, 2026 Patched in ["7.1.1"] CVE-2026-42674

Advanced Access Manager <= 6.9.20 - Reflected Cross-Site Scripting Medium

March 20, 2024 Patched in ["6.9.21"] CVE-2024-29127

Advanced Access Manager <= 6.9.20 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 16, 2024 Patched in ["6.9.21"] CVE-2024-29124

Advanced Access Manager <= 6.9.18 - Authenticated (Author+) Open Redirect Medium

December 27, 2023 Patched in ["6.9.19"] CVE-2023-51675

Advanced Access Manager <= 6.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

December 27, 2023 Patched in ["6.9.19"] CVE-2023-51674

Advanced Access Manager <= 6.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

December 26, 2023 Patched in ["6.9.16"] CVE-2023-50881

Advanced Access Manager <= 6.7.9 - Admin+ Stored Cross-Site Scripting Medium

October 19, 2021 Patched in ["6.8.0"] CVE-2021-24830

Advanced Access Manager <= 6.6.1 - Authenticated Information Disclosure Medium

August 20, 2020 Patched in ["6.6.2"] CVE-2020-35934

Advanced Access Manager <= 6.6.1 - Authenticated Authorization Bypass and Privilege Escalation High

August 14, 2020 Patched in ["6.6.2"] CVE-2020-35935

Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read Critical

September 9, 2019 Patched in ["5.9.9"] CVE-2019-25213

Advanced Access Manager <= 3.2.1 - Unrestricted AJAX Actions allowing Privilege Escalation High

June 21, 2016 Patched in ["3.2.2"]

Advanced Access Manager <= 2.8.2 - Arbitrary File Overwrite High

August 20, 2014 Patched in ["2.8.3"] CVE-2014-6059

What It Does

Advanced Access Manager is an access governance plugin that lets administrators define granular permissions for roles, individual users, content, admin screens, and WordPress REST API endpoints. It goes beyond simple role editors by enforcing restrictions on backend menus, pages, posts, and custom post types based on user, role, or capability. In practice, you can lock down sensitive admin areas, hide content from specific roles, and restrict which API routes different user types can call.

Who It's For

This plugin is built for organizations running WordPress in regulated, multi-user, or client-facing environments where access control is a compliance or security requirement. Healthcare portals, legal document management systems, membership sites with tiered content, education LMS platforms, and agencies juggling multiple client sites will get the most value. It suits teams that need to enforce least-privilege access without writing custom code.

Who Should Skip It

If you run a personal blog, small business brochure site, or simple WooCommerce store with one or two staff, this plugin is overkill and adds administrative complexity you do not need. Sites already covered by a security suite like Wordfence or Jetpack plus a basic role editor like User Role Editor will rarely benefit from layering AAM on top.

The Bottom Line

Advanced Access Manager delivers exactly what its name promises: detailed control over who can see and do what inside WordPress, and its 82.49/100 overall score reflects a well-maintained, broadly compatible plugin with strong user satisfaction. The 0 percent resolved support thread rate is the one notable concern, so buyers should not rely on fast forum help and should test changes on staging first. For sites with real access governance needs, it is a strong choice; for everyone else, a lighter solution will do.

Pick this if your primary concern is SSL enforcement and broad site hardening rather than granular role-based content access.

Wordfence Security – Firewall, Malware Scan, and Login Security 97/100

Choose Wordfence when you need a full security stack with firewall, malware scanning, and login protection that complements, but does not replace, access control.

Jetpack – WP Security, Backup, Speed, & Growth 94/100

Choose Jetpack if you want an all-in-one suite covering security, backups, performance, and growth tools rather than deep access governance.

All-In-One Security (AIOS) – Security and Firewall 91/100

Pick AIOS when you want free, broad-spectrum security hardening with login lockdown and firewall rules but do not need API endpoint or content-level access governance.

Safe SVG 89/100

Safe SVG solves an entirely different problem (allowing SVG uploads safely) and is only a relevant alternative if your access concerns are narrowly about media permissions.