Four Security Fixes in Two Popular WordPress Plugins: Update Loginizer and Members

This week, two WordPress plugin vendors released security fixes for issues we reported to them privately. Loginizer, a login security plugin on more than 1,000,000 sites, fixed one. Members, a user role and content restriction plugin on more than 300,000 sites, fixed three. Both name us in their changelogs.

If your website runs on WordPress and uses either plugin, the one thing to do is update it.

What to update

• Loginizer: update to version 2.1.3 or later, released October 29, 2026.
• Members: update to version 3.3.1 or later, released October 30, 2026. This version needs PHP 8.0 or newer, so if the update won't install, ask your web host which PHP version your site runs.

What was fixed

We're keeping this short on purpose. The fixes are only days old, and plenty of sites haven't updated yet, so we won't publish anything that would help someone take advantage of these issues.

Loginizer 2.1.3 fixes a security issue in the HybridAuth library behind the plugin's Social Login feature, the part that lets visitors sign in with an outside account. Softaculous, the company that makes Loginizer, credits us in its release post and the WordPress.org changelog.

Members 3.3.1 fixes three issues, each published as a GitHub security advisory rated medium:

• Restricted posts in the Latest Posts block. A post limited to certain members could be read by a visitor who wasn't signed in, when the post appeared in a Latest Posts block set to show full content. (Advisory)
• Comments on restricted posts in the Latest Comments block. Comments on a members-only post could be read by a visitor who wasn't signed in. (Advisory)
• A page-breaking error. An account with Author access could save a block in a way that stopped every page showing that post from loading. (Advisory)

The first two matter most to sites that keep content for members, clients or staff behind a login. MemberPress, the company behind Members, credits us for all three in the WordPress.org changelog. CVE IDs have been requested and we'll add them here once they're assigned.

How to check your plugin versions

• Sign in to your WordPress dashboard and open Plugins. Each plugin shows its version number under its name, and an "update now" link if a newer one is out.
• Check Dashboard, then Updates. This lists every plugin with an update waiting.
• Turn on automatic updates for plugins you trust. On the Plugins page, the "Enable auto-updates" link beside each plugin keeps it current without anyone having to remember.

If someone else looks after your website, send them this page and ask them to confirm both plugins are up to date.

How we report security issues

We look for security problems in software that small businesses rely on, and report them privately to the people who make it. We give them time to fix it, and we don't publish details of anything that isn't fixed. Both vendors here confirmed the issues, released fixes and published them with credit, which is how this process is meant to work.

You can see our other credits and disclosures, and how to report a vulnerability to us, on our security research page. If you'd like the same kind of testing done on your own website or systems, that's what a penetration test is for. And if you think your site has already been tampered with, we offer hacked website cleanup.