1.3.8 - 28th September 2026

• Fix: Fatal error when WPUM Security is active alongside WPUM Groups or WPUM Frontend Posting
• Improvement: Tested up to WordPress 7.1

1.3.7 - 19th September 2026

• Security Fix: The two-factor authentication account settings form now requires a security nonce
• Fix: PHP 8.1+ deprecation notices when logging in with a backup code or two-factor authentication
• Fix: Fatal error in the Disabled users column when the admin who disabled the user has been deleted
• Improvement: Escaping and sanitization hardening throughout
• Tweak: Themes overriding forms/form-two-factor-account.php need to add the new wp_nonce_field( 'wpum_two_factor_account', '_wpum_two_factor_nonce' ) call

1.3.6 - 18th September 2026

• Security Fix: Disable, enable and send passwordless link user actions now require the correct permissions

1.3.5 - 18th September 2026

• Fix: Last Login and Disabled user columns showed the month in place of minutes
• Fix: Last Login and Disabled user columns now use the site timezone instead of UTC

1.3.4 - 13th July 2024

• Fix: 2FA QR code not appearing
• Fix: Block list not respected when users edit their email address in the account area
• Fix: Block list not matching domains with leading @ in the list
• Fix: 'wpum_security_passwordless_login_delay' filter to stop email systems preloading login link and expiring it

1.3.3 - 16th March 2023

• New: Ability to disable instead of deleting users after a period of inactivity
• Improvement: Security settings arranged into tabs for clarity
• Fix: Password functionality not working on login form when 2FA enabled

1.3.2 - 5th January 2023

• Fix: 2FA login step can no longer be bypassed
• Fix: Fatal error no longer happens on the wp-login page when users can be deactivated

1.3.1 - 12th September 2022

• Fix: PHP Fatal error: Uncaught Error: Class 'WPUM_Form' not found with WP User Manager 2.8.9

1.3 - 22nd July 2022

• New: Site admins can now deactivate users to prevent them from logging in
• New: Site admin can now define an 'Allow list' of emails, domain and strings to restrict user registration
• New: 'Send Passwordless login email' bulk and user row action on the Users admin table
• Improvement: User ID now a sortable column on the Users admin table
• Fix: 2FA login now works when backup codes enabled

1.2.3 - 19th July 2022

• Fix: 2FA account form now saving correctly

1.2.2 - 26th May 2022

• Fix: Passwordless login now compatible when the whole site is locked preventing access

1.2.1 - 22nd August 2021

• Fix: Lost password links showing on login and registration forms

1.2 - 12th August 2021

• New: Passwordless login
• New: Last login date displayed in the user admin table

1.1.2 - 8th June 2021

• New: Setting to allow concurrent logins from admin users
• Improvement: Only show the password strength meter setting in the admin if strong passwords are disabled
• Fix: Confirm password field appearing above the password field for some users
• Fix: Password strength meter leaving a blank space under the password field

1.1.1 - 23rd April 2021

• Fix: Fix show password field button hijacking tab order

1.1 - 12th April 2021

• New: Two Factor Authentication support

1.0

Initial release