User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

90 Quality Score

Active Installs

21/30

With 50,000 active installs the user base is solid but mid-sized, well behind category leaders like Ultimate Member at 200,000 installs, which keeps the popularity score at a moderate 70.

Update Freshness

25/25

The plugin was updated in July 2026 and is tested against WordPress 7.0.1 with PHP 7.4 as the minimum, indicating very active maintenance.

User Rating

14/15

A 96 out of 100 rating from 825 reviewers is exceptionally strong and reflects broad satisfaction across the install base.

Support Health

15/15

Of 19 support threads, 17 are resolved for an 89.5% resolution rate, which is good, though the low absolute thread count means a smaller sample than busier plugins.

WP Compatibility

15/15

Requiring WordPress 5.5 and PHP 7.4 and testing against 7.0.1 earns a perfect compatibility score and broad reach across current hosting environments.

Scores higher than 99% of indexed plugins

About

Build membership sites with tiered plans, content restriction, drag-&-drop custom registration & login form builder, and built-in payment system.

Active Installs 50k+

Rating ★★★★½ 4.8/5

Last Updated 2026-09-10 11:43am GMT

Requires WordPress 5.5+

Tested Up To 7.1

Requires PHP 7.4+

Security History

55 known vulnerabilities, all patched

4 Critical 9 High 42 Medium

Most recent: September 16, 2026

View details ▸

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization Medium

September 16, 2026 Patched in ["5.2.8"] CVE-2026-74017

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation Medium

September 14, 2026 Patched in ["5.2.8"] CVE-2026-80071

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 - 5.2.7 - Authenticated (Subscriber+) Privilege Escalation Medium

September 14, 2026 Patched in ["5.2.8"] CVE-2026-86406

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 5.0 - 5.2.7 - Unauthenticated Information Exposure Medium

September 13, 2026 Patched in ["5.2.8"] CVE-2026-86407

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Unauthenticated Open Redirect High

September 11, 2026 Patched in ["5.2.8"] CVE-2026-80072

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.5 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

August 28, 2026 Patched in ["5.2.5"] CVE-2026-79995

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.6 - Authenticated (Custom Role+) Privilege Escalation Medium

August 28, 2026 Patched in ["5.2.6"] CVE-2026-79996

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization Medium

August 14, 2026 Patched in ["5.2.7"] CVE-2026-73995

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization Medium

August 13, 2026 Patched in ["5.2.7"] CVE-2026-73403

User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled Medium

July 27, 2026 Patched in ["5.2.6"] CVE-2026-16736

User Registration & Membership <= 5.2.2 - Missing Authorization to Unauthenticated User Deletion via Stripe Handler Medium

June 26, 2026 Patched in ["5.2.3"] CVE-2026-11966

User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation High

June 26, 2026 Patched in ["5.2.3"] CVE-2026-11961

User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass Medium

June 25, 2026 Patched in ["5.2.1"] CVE-2026-1869

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization Medium

June 22, 2026 Patched in ["5.2.3"] CVE-2026-52701

User Registration & Membership <= 5.2.1 - Unauthenticated PayPal Bypass to Membership Activation Medium

June 22, 2026 Patched in ["5.2.2"] CVE-2026-11964

User Registration & Membership <= 5.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification Medium

June 22, 2026 Patched in ["5.2.2"] CVE-2026-11963

User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass Medium

June 11, 2026 Patched in ["5.2.0"] CVE-2026-11965

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization Medium

May 28, 2026 Patched in ["5.1.3"] CVE-2026-25425

User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter Medium

May 27, 2026 Patched in ["5.1.6"] CVE-2026-7651

User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter Medium

May 13, 2026 Patched in ["5.1.6"] CVE-2026-6145

User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification Medium

May 4, 2026 Patched in ["5.1.5"] CVE-2026-3601

User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter Medium

April 13, 2026 Patched in ["5.1.5"] CVE-2026-6203

User Registration <= 5.1.5 - Reflected Cross-Site Scripting Medium

April 9, 2026 Patched in ["5.1.6"] CVE-2026-42652

User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] Medium

April 7, 2026 Patched in ["5.1.3"] CVE-2026-1865

User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation Medium

March 23, 2026 Patched in ["5.1.5"] CVE-2026-4056

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution Critical

March 23, 2026 Patched in ["5.1.3"] CVE-2026-32488

User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration Critical

March 2, 2026 Patched in ["5.1.3"] CVE-2026-1492

User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Medium

February 25, 2026 Patched in ["5.1.3"] CVE-2026-2356

User Registration & Membership <= 5.1.2 - Authentication Bypass High

February 25, 2026 Patched in ["5.1.3"] CVE-2026-1779

User Registration <= 4.4.6 - Missing Authorization Medium

January 21, 2026 Patched in ["4.4.7"] CVE-2025-67956

User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion Medium

January 9, 2026 Patched in ["4.4.9"] CVE-2025-14976

User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Medium

January 8, 2026 Patched in ["5.0"] CVE-2026-24353

User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Medium

December 15, 2025 Patched in ["4.4.7"] CVE-2025-13367

User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection Medium

September 5, 2025 Patched in ["4.4.0"] CVE-2025-9085

User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode Medium

July 21, 2025 Patched in ["4.3.0"] CVE-2025-6831

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion Medium

May 5, 2025 Patched in ["4.2.2"] CVE-2025-3281

User Registration <= 4.1.5 - Reflected Cross-Site Scripting Medium

April 22, 2025 Patched in ["4.2.0"] CVE-2025-39400

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update Medium

April 11, 2025 Patched in ["4.1.4"] CVE-2025-3292

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification Medium

April 11, 2025 Patched in ["4.1.4"] CVE-2025-3282

User Registration & Membership <= 4.1.2 - Authentication Bypass High

April 1, 2025 Patched in ["4.1.3"] CVE-2025-2594

User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 27, 2025 Patched in ["4.0.4"] CVE-2025-30899

User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation Critical

March 24, 2025 Patched in ["4.1.2"] CVE-2025-2563

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting Medium

February 27, 2025 Patched in ["4.1.0"] CVE-2025-1511

User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation High

May 31, 2024 Patched in ["3.2.1"] CVE-2024-4958

User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation High

April 19, 2024 Patched in ["3.2.0"] CVE-2024-2417

User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion Medium

April 15, 2024 Patched in ["3.2.0"] CVE-2024-3295

User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting Medium

March 6, 2024 Patched in ["3.1.5"] CVE-2024-1720

User Registration – Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

October 16, 2023 Patched in ["3.0.4.2"] CVE-2023-5228

User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload Critical

July 4, 2023 Patched in ["3.0.2.1"] CVE-2023-3342

User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection High

June 29, 2023 Patched in ["3.0.2"] CVE-2023-3343

User Registration <= 2.3.2.1 - Missing Authorization via send_test_email Medium

April 6, 2023 Patched in ["2.3.3"] CVE-2023-29429

User Registration <= 2.3.2.1 - PHP Object Injection High

March 21, 2023 Patched in ["2.3.3"] CVE-2023-27459

User Registration <= 2.3.0 - Authenticated (Administrator+) Stored Cross Site Scripting Medium

January 20, 2023 Patched in ["2.3.1"] CVE-2023-23987

User Registration <= 2.2.4 - Authenticated (Subscriber+) Arbitrary File Upload High

November 21, 2022 Patched in ["2.2.41"] CVE-2022-3912

User Registration <= 1.5.5 - Cross-Site Scripting Medium

January 9, 2019 Patched in ["1.5.6"]

What It Does

User Registration & Membership lets site owners build custom registration and login forms using a drag-and-drop builder, then gate content and create paid or free membership tiers with recurring subscriptions. It ships with a built-in payment system, user profile management, and content restriction rules so visitors can sign up, pay, and unlock protected pages or posts.

Who It's For

This plugin is a good fit for small-to-medium businesses, course creators, and content publishers who want to launch a paid membership site on WordPress without stitching together five separate plugins. It works well for solo operators who prefer an all-in-one solution with built-in payments over a heavier stack like WooCommerce Subscriptions plus a separate membership add-on.

Who Should Skip It

If you only need a simple contact or registration form with no paywall, a lighter plugin like WPForms or Formidable Forms will do the job without the membership overhead. Large enterprises or sites already running WooCommerce with full subscription management should look at dedicated e-commerce membership tools instead.

The Bottom Line

User Registration & Membership delivers a genuinely capable all-in-one membership toolkit with top-tier ratings, recent updates, and a perfect compatibility score, making it a strong default choice for most membership sites. Its 50,000 installs and modest support volume suggest it is less battle-tested than Ultimate Member, so very high-traffic communities may still prefer that larger ecosystem. Overall Quality Score: 88.86 out of 100.

Related Plugins

User Profile Builder 90/100

Choose Profile Builder if you want cleaner profile editing and a polished front-end user experience and you do not need the built-in payment engine.

Ultimate Member 90/100

Pick Ultimate Member when you need a larger community, member directories, and a deeper ecosystem of third-party extensions, accepting the heavier footprint.

Hostinger Reach 89/100

Hostinger Reach is the better pick if your priority is AI-driven email marketing rather than full membership management.

Paid Membership Subscriptions 86/100

Paid Membership Subscriptions is a lighter alternative if you only need simple recurring payments and content restriction without a form builder.

Newsletter 85/100

Newsletter suits sites that mainly need email list building and automation rather than paid memberships or content gating.

Compare User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 90/100

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vs Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 88/100

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder vs Newsletter – Send awesome emails from WordPress 85/100