On June 4, 2023, monitoring at the host Pressable logged a first wave of administrator accounts created on WordPress sites, with names such as “wpadmins”. What those sites had in common: a widely used membership plugin, Ultimate Member, whose registration form let a stranger declare themselves an administrator. It would take a month and four versions for the flaw to be truly closed.
That story sums up what a membership plugin is. It is a gate, which decides who sees which content, and a cash register, which collects every month. The gate is exposed to the public through its forms. The cash register fails silently: an expired card, a declined payment, a subscription that dies without anyone following up.
This comparison judges ten plugins on those two machines: how fine-grained the access rules are, the payment gateways, what happens when a payment fails, and what an export really contains on the day you want to switch tools. Prices are those displayed in October 2026.
How we ranked them
We read the official pages, the documentation, the WordPress.org directory listings and, when the vendor was silent, the source code itself. That is how we found the fees some free versions take, which their product pages do not mention.
Six criteria matter. Restriction granularity: post, category, content type, block, URL. The gateways supported without an add-on. Who retries a failed payment, the plugin or the gateway. What an export contains. The vendor’s stability and its security record. The real cost, including per-payment fees and renewal prices.
1. MemberPress: the most complete all-in-one, as long as you avoid Launch
What it does
MemberPress, published by Caseproof, is the best-known commercial all-in-one solution: access rules, checkout, subscriptions, courses and coaching. It is not in the WordPress.org directory and is downloaded from the vendor’s site.
Strengths
Its rules screen is the most fine-grained in this comparison: a post, a category, a tag, a page and its child pages, a content type, a URL with regular expressions, or part of a page through a shortcode. From the Growth plan, each rule can drip content, starting from registration or a date, and expire it.
Limits
The Launch plan only accepts Stripe and takes 4.9% of every successful payment, on top of Stripe’s own fees. PayPal and Square only come with the Growth plan. MemberPress has no retry engine of its own: it relies on the gateway’s settings, and sends failed payment and card expiry emails.
Price and audience
At the time of writing, Launch costs $199.50 for the first year, Growth $349.50 and Scale $499.50. These are introductory prices: renewals are at full price, $399, $699 and $999. MemberPress suits creators and small businesses that want one vendor for everything, from the Growth plan up.
2. Paid Memberships Pro: open source, outside the official directory
What it does
Paid Memberships Pro, from Stranger Studios, is an open-source membership platform with a free core and many add-ons. On October 17, 2024, its publisher had its WordPress.org listing permanently closed. Its CEO, Jason Coleman, explained that he no longer wanted to depend on a directory controlled by Matt Mullenweg, whose company publishes WooCommerce, described as its main competitor.
The plugin is now downloaded from the vendor’s site or GitHub, and its updates come from its own license server.
Strengths
Restrictions cover pages, posts, blocks, categories and content types, with an excerpt visible to non-members. Stripe, PayPal and manual payment are included, other gateways come as add-ons, and all of them handle recurring subscriptions. For a migration, the CSV import can link a member to their existing Stripe subscription.
Limits
The free version takes 2% of every Stripe payment, a fee that disappears with a paid license: you only discover it when connecting Stripe. On the PayPal side, the plugin cancels the subscription at the first payment failure, unless you customize it in code. It can no longer be installed from the dashboard search.
Price and audience
At the time of writing, the Standard plan costs $499 per year for one site, with every add-on. The Max plans now include managed hosting. Paid Memberships Pro suits developers and organizations, associations or publishers, that want open code and many add-ons.
3. WooCommerce Memberships and Subscriptions: the best-documented built-in retry system
What it does
Two paid extensions work together. WooCommerce Subscriptions, built by the WooCommerce team, handles recurring billing. WooCommerce Memberships, built by SkyVerge, a GoDaddy subsidiary, handles access and member-only discounts.
Strengths
Rules cover content but also products: a member can be the only one able to see or buy certain items, with dedicated discounts. Above all, Subscriptions has the best-documented retry engine in this comparison: five new attempts spread over seven days, with emails to the customer and the merchant.
Limits
That engine is off by default. You have to turn it on in the Subscriptions settings, under payment recovery, otherwise a failure stays a failure. It does not apply to SEPA direct debit. The Memberships export only contains memberships, with no subscription or payment data. Finally, two licenses, two vendors, and the full weight of WooCommerce.
Price and audience
At the time of writing, Memberships costs $199 per year and Subscriptions $279, $478 together. This pair suits WooCommerce stores that sell products plus restricted access or member pricing; our comparison of WooCommerce payment gateways helps you choose one that handles recurring payments well.
4. MemberMouse: billing brought back onto the site
What it does
MemberMouse targets high-volume info-product sellers: one-click upsells, save-the-sale offers, analytics. Since January 2023 it has belonged to Caseproof, MemberPress’s parent company, which promised to keep the two products separate.
Strengths
It is one of the few that retries a failed payment itself: new attempts two, five and seven days after the first failure, then access is removed. Access follows billing status, and member import and export are included in every plan.
Limits
Those retries only work with gateways that keep the card on file. With PayPal, MemberMouse has no control. Since version 3.0, rebilling of stored cards, with Stripe, Braintree or Authorize.net in CIM mode, runs entirely on your site and depends on WP-Cron, which must not be disabled: a site whose scheduled tasks run poorly bills poorly, as our guide to WP-Cron and system cron explains.
Price and audience
At the time of writing, the Basic plan costs $149.50 for the first year, Plus $249.50 and Pro $349.50, with renewals at full price, $299, $499 and $699. MemberMouse suits course sellers with sales funnels who want to keep billing in-house.
5. Kadence Memberships, formerly Restrict Content Pro: a good tool sold in a bundle
What it does
Restrict Content Pro is now called Kadence Memberships, under the Liquid Web and Nexcess brand. In spring 2026, Liquid Web stopped selling it on its own: its advanced features now only come in the Kadence plans. The transition was bumpy, with login problems and missing invoices reported by users.
Strengths
The free version, in the directory, already handles Stripe and manual payment, restricts posts, pages, content types, archives and blocks, and hides restricted content even in the REST API. Member and payment exports to CSV are available at any time.
Limits
The free version adds a 2% fee to Stripe payments made on the site, which only the Pro version removes: the plugin says so in its Stripe settings, not on its directory listing. For PayPal, Authorize.net, Braintree or drip content, you have to buy an entire site-building bundle. An existing Restrict Content Pro license only keeps its price while it stays active. Three serious flaws were fixed in 2026, including one that allowed account takeover through a poisoned password reset link.
Price and audience
At the time of writing, the advanced membership features are included in Kadence Pro, at $299 per year per site, and Kadence Elite, at $499. Kadence Memberships suits sites already built with Kadence and existing customers who keep renewing.
6. Paid Member Subscriptions: the free start that takes 2%
What it does
Paid Member Subscriptions, from Cozmoslabs, the publisher of Profile Builder and TranslatePress, has more than 10,000 active installs and a good rating in the directory. It combines membership and subscriptions in an already complete free version.
Strengths
Stripe, PayPal and manual payment are included. It has its own retry engine, to turn on: a new attempt every three days, three times at most, two values you can change in the free version. Member and payment history exports to CSV are available at any time.
Limits
Like Paid Memberships Pro, the free version takes 2% of Stripe payments of at least $5 or €5 as long as no valid license is entered: it is written in its code, and a user complained about it in August 2026. Global restrictions and drip content are paid add-ons. In 2026, a fixed flaw let a visitor without an account bypass payment for a membership.
Price and audience
At the time of writing, the Basic plan costs €99 per year for one site, with no fee, Pro €169 for three sites and Agency €299 with no limit. Paid Member Subscriptions suits small European publishers that want euro pricing and a free start.
7. ARMember: twenty-two gateways, but outside the directory
What it does
ARMember, from Repute InfoSystems, stands out for the range of its gateways: Stripe, Mollie, Razorpay, PagSeguro, Paystack, Mercado Pago and many more. Its Lite version was closed in the WordPress.org directory on February 1, 2025, for a “Guideline Violation”, with no public detail. It is still distributed from the vendor’s site and GitHub.
Strengths and limits
Each plan sets what happens after a failed payment: a grace period, then removal of the membership or a move to another plan. A free tool imports members from Paid Memberships Pro or MemberPress. On the other hand, the Lite version only handles PayPal and bank transfer, and can no longer be installed from the dashboard.
Price and audience
At the time of writing, the Standard plan costs $89 per year for one site, renewing at the same price, Professional $139 for two sites and Enterprise $299 for ten. ARMember suits international sites that need a local gateway, in India, Brazil or Africa, without WooCommerce.
8. SureMembers: a gate, not a cash register
What it does
SureMembers, from Brainstorm Force, the publisher of the Astra theme, only handles access. It has no checkout: you sell access with SureCart, SureForms or WooCommerce. A free core arrived in the directory in March 2026.
Strengths and limits
Its rules are fine-grained from the free version: the whole site, any content type, taxonomies, URLs with regular expressions, exclusions and priorities. The paid version adds block-level restriction, drip content and a limit on simultaneous logins. But you have to buy two products, and SureCart’s free plan takes 2.9% per transaction.
Price and audience
At the time of writing, the Starter plan costs $69 for the first year, instead of $99, for one site. SureMembers suits Astra and SureCart users who want to put a light gate in front of an existing store.
9. Ultimate Member: community first
What it does
Ultimate Member, with more than 200,000 active installs, is first of all a community plugin: registration, profiles, member directories and role-based content restriction. Payment is not part of the core.
Strengths
Restrictions are set by content type, by term or by post, and by block: everyone, logged-in visitors or certain roles, with a message or a redirect. For an association directory or a professional network, it is the most natural tool.
Limits
Billing goes through a paid Stripe extension or through WooCommerce. The Stripe extension maps a WordPress role to each subscription status, active, past due, unpaid or canceled, and leaves retries to Stripe. Ultimate Member has no built-in export tool. And its registration form, public on hundreds of thousands of sites, has a history.
Price and audience
At the time of writing, the Stripe extension alone costs $65 per year for one site. The Standard plan, which bundles 21 extensions without Stripe, costs $276 per year for one site, and the Pro plan, which adds Stripe and Zapier, $348 per year for two sites. Ultimate Member suits communities, directories and associations where profiles matter more than billing.
The real case: the summer a registration form created administrators
Ultimate Member’s CVE-2023-3460 flaw is one of the best-documented incidents in the history of membership plugins. WPScan published a detailed timeline, Wordfence an alert, the vendor an incident page with its apologies. It shows what a registration form can open.
A blocklist bypassed
Ultimate Member’s registration form let the visitor send user metadata. To prevent abuse, the plugin rejected a list of forbidden keys, including wp_capabilities, the metadata that stores an account’s role. But a blocklist can be bypassed: by playing with uppercase letters, slashes or character encoding, an attacker could still write to that key.
Marc Montpas, a security researcher at Automattic, WPScan’s parent company, pointed to the source of that behavior: the collation WordPress uses in its database treats as identical some variants that PHP sees as different. A key written with random capital letters got past the plugin’s filter, and the database treated it as wp_capabilities. The visitor became an administrator.
One month, four versions
The first wave of attacks was logged on June 4, 2023. On June 26, a privilege escalation was reported to the vendor. On June 27, version 2.6.4 came out, still vulnerable; the same day, Joshua Goode, of Pressable, confirmed active exploitation and alerted WPScan. Versions 2.6.5 and 2.6.6, on June 28 and 29, were still exploitable.
On June 29, WPScan published its analysis and Wordfence its alert. Wordfence described the flaw as unpatched, protected its paying customers with a firewall rule, announced the same rule for free users thirty days later, and advised uninstalling the plugin until a complete fix was available.
On July 1, version 2.6.7 replaced the blocklist with an allowlist of permitted keys, and separated the form settings from the submitted data. WPScan confirmed the fix on July 3, and the CVE-2023-3460 record, whose identifier had been circulating since June 29, was published on July 4, noting active exploitation. Sites hosted on Automattic’s platform, WordPress.com and Pressable, had in the meantime received a platform-level fix.
What the attackers left behind
The published indicators describe a full takeover: administrator accounts with plausible names, malicious plugins installed, backdoors, and changes to the theme’s functions.php file that attempted to create a persistent user account. Updating the plugin therefore cleaned up nothing.
The vendor apologized and recommended deleting unknown administrators, resetting every password, running a security scanner and informing users. The flaw is not in the US agency CISA’s catalog of exploited vulnerabilities, but WPScan and Wordfence both observed its exploitation.
What the story teaches
A registration form is a public write path into the users table. A list of forbidden keys often leaves room for bypasses; a list of permitted keys is far safer. Next, “updated” did not mean “protected”: three versions in three days were still exploitable. You have to read the security advisory, not just the version number.
Finally, the first signals came from the host, which saw administrators appearing from June 4, more than three weeks before the flaw was reported to the vendor. Monitoring the creation of administrator accounts, as our guide to WordPress security hardening recommends, would have raised the alarm much earlier.
2026: the same defect, elsewhere
This family of flaws has not gone away. In March 2026, attackers exploited a flaw in the User Registration & Membership plugin, fixed in late February in version 5.1.3, which accepted a role supplied by the visitor at registration: Wordfence blocked more than two hundred attempts in twenty-four hours. Ultimate Member itself fixed two flaws in July and August 2026 related to the roles offered in its forms, this time only if a role selection field was configured.
10. s2Member: the veteran with a one-time license
What it does
s2Member, in the directory since 2010, protects posts, pages, categories, tags, URLs, portions of content and downloadable files, and limits account sharing by IP address or simultaneous logins.
Strengths and limits
Its Pro version is paid once, which is rare. On the other hand, the free version only handles PayPal buttons and at most four paid levels, its admin interface has aged, and several critical flaws were reported in 2026, including unauthenticated remote code execution. CSV import and export are reserved for the Pro version.
Price and audience
At the time of writing, s2Member Pro costs $89 as a one-time purchase for one site and $189 for unlimited sites. It suits sites that have used it for a long time and developers who prefer a one-time license.
Retries and failed payments: who does what
The plugin or the gateway
For MemberPress, Paid Memberships Pro, Kadence Memberships, Ultimate Member and s2Member, the gateway alone retries a declined payment. Paid Memberships Pro says so clearly: the gateway retries the charge, notifies the customer and decides whether to continue or cancel. The plugin simply draws the consequences for access.
Only three tools retry the card themselves: WooCommerce Subscriptions and Paid Member Subscriptions, whose engine has to be turned on, and MemberMouse, which retries by default with gateways that keep the card on file. ARMember makes no new attempt: it grants a grace period before removing or changing the membership.
The settings to check in Stripe
In Stripe, retries are set in the billing settings, under revenue recovery. The default recommended Smart Retries setting is eight attempts within two weeks. Also choose what happens after the last one: cancel the subscription, mark it unpaid, leave it past due or pause it. Your plugin will react to that status.
The emails that save a subscription
A member whose card expires is not a lost member, if they are warned in time. Turn on the failed payment, card expiry and pre-renewal reminder emails, often off by default. In Paid Member Subscriptions, the failed payment email is on from installation, but automatic retries still have to be turned on.
Canceling must stay simple
In France, since June 1, 2023, a consumer contract that can be concluded online must be cancelable online in three clicks, with fines of up to €75,000 for a company. Check that your members can cancel on your site without detours. In the United States, the FTC’s equivalent rule was struck down by a federal appeals court in July 2025.
Portability: what your export really contains
Members, not subscriptions
A member export contains accounts, plans and dates. It does not contain the subscription itself, which lives at the gateway. MemberPress puts it bluntly: its import cannot create any subscription or trigger any charge.
Linking the gateway IDs
A subscription survives a plugin switch only if the new tool can attach it to its ID at the gateway: an ID starting with sub_ at Stripe, with I- at PayPal. Paid Memberships Pro and MemberPress allow it at import. Without that step, every member will have to re-enter their card.
The bad surprises
Ultimate Member has no export tool. The WooCommerce Memberships export leaves out subscription and payment data. s2Member reserves export for its Pro version. Before choosing, look at how you would get out.
How to choose
- A creator selling content and courses: MemberPress from the Growth plan, or Paid Memberships Pro with a license.
- A WooCommerce store: WooCommerce Memberships and Subscriptions, with retries turned on.
- A high-volume course seller: MemberMouse, with a reliable WP-Cron.
- An association or a directory: Ultimate Member, with monitoring of created accounts.
- A small European publisher: Paid Member Subscriptions, with a license to remove the fee.
- A site already on Kadence or Astra: Kadence Memberships or SureMembers.
In every case, do the math over three years, per-payment fees and full-price renewals included. If you also sell courses, our comparison of WordPress LMS plugins complements this one.
Summary table
| Plugin | Directory | Entry price (Oct. 2026) | Failed payment retries | Export |
|---|---|---|---|---|
| MemberPress | Vendor only | $199.50 first year, plus 4.9% per payment | Gateway | CSV, import via add-on |
| Paid Memberships Pro | Left in 2024 | Free with 2% on Stripe | Gateway | Yes, Stripe linking at import |
| WooCommerce Memberships and Subscriptions | Marketplace | $478 per year | Built in, to turn on | Memberships only |
| MemberMouse | Vendor only | $149.50 first year | Built in, cards on file | Yes |
| Kadence Memberships | Yes (free version) | Free with 2% on Stripe, advanced in Kadence Pro at $299 | Gateway | Members and payments |
| Paid Member Subscriptions | Yes | Free with 2% on Stripe, €99 per year without | Built in, to turn on | Members and payments |
| ARMember | Closed in 2025 | $89 per year | Grace period per plan | Yes |
| SureMembers | Yes (core) | $69 first year, plus SureCart | Through SureCart or WooCommerce | Import only |
| Ultimate Member | Yes | Free, Stripe at $65 per year | Stripe | None |
| s2Member | Yes | Free, Pro $89 one-time | Gateway | Pro version |
Frequently asked questions
Can I switch plugins without losing active subscriptions?
Yes, if the new plugin can attach each member to their existing subscription at the gateway, through their Stripe or PayPal ID. Otherwise, members will have to subscribe again. Test the import in test mode before switching.
Do the free versions take a fee?
Some do: 2% of Stripe payments for Paid Memberships Pro, Paid Member Subscriptions and Kadence Memberships without a license, 2.9% for SureCart’s free plan. MemberPress’s Launch plan, although paid, takes 4.9%. The gateway’s own fees come on top.
Do I need WooCommerce to sell memberships?
No. MemberPress, Paid Memberships Pro, MemberMouse or Paid Member Subscriptions take payments on their own. WooCommerce becomes relevant if you also sell products, or if you want member-only pricing.
Who retries a declined payment?
Most often the gateway, according to your settings there. WooCommerce Subscriptions, MemberMouse and Paid Member Subscriptions have their own engine; those of WooCommerce Subscriptions and Paid Member Subscriptions have to be turned on. Check that setting at launch.
Do plugins outside the directory still get updates?
Yes, from their vendor’s server: that is the case for Paid Memberships Pro, MemberPress, MemberMouse and ARMember. Simply check that they actually reach your dashboard, with an active license.
What should I do if a membership plugin has a flaw?
Update, then check the list of administrators, the installed plugins and the theme files. An update closes the door, it does not throw out those who are already inside.
Conclusion
A membership plugin is judged on two machines. The gate must be fine-grained and solid, because its forms are public. The cash register must retry failed payments and let your members go the day you switch tools. MemberPress and Paid Memberships Pro are the most complete, WooCommerce Subscriptions retries best, Ultimate Member rules communities.
Ultimate Member’s story recalls the essentials: a registration form can manufacture administrators. Update quickly, monitor the accounts being created, and read the fine print of free versions before trusting them with your revenue.
Sources
- MemberPress (October 2026). Pricing
- MemberPress. Rules Overview
- MemberPress. Migrating or Importing Automatically Recurring Subscriptions
- MemberPress (updated February 2026). Failed Payments: How to Handle Them in Your Membership Site
- WordPress.org (closed October 17, 2024). Paid Memberships Pro
- Paid Memberships Pro, Jason Coleman (October 28, 2024). Leaving WordPress.org
- Paid Memberships Pro (October 2026). Pricing
- Paid Memberships Pro (May 21, 2026). How PMPro Handles Failed Payments
- Paid Memberships Pro. Migrating Stripe Subscriptions to Paid Memberships Pro
- GitHub, Stranger Studios. Paid Memberships Pro, Stripe gateway source
- WooCommerce (October 2026). WooCommerce Memberships
- WooCommerce (October 2026). WooCommerce Subscriptions
- WooCommerce. Failed Recurring Payment Retry System
- WooCommerce. WooCommerce Memberships Import and Export
- MemberMouse (October 2026). Plans
- MemberMouse. Automated Overdue Payment Handling
- MemberMouse. Important Changes for MemberMouse 3.0
- PRWeb (March 9, 2023). MemberPress Parent Company Caseproof Acquires MemberMouse
- WordPress.org (October 2026). Membership Plugin, Kadence Memberships
- Liquid Web (2026). The next era for software
- Liquid Web (October 2026). Kadence plans and pricing
- Search Engine Journal, Roger Montti (May 13, 2026). Liquid Web WordPress Plugin Rebrand Triggers Backlash
- WordPress.org (October 2026). Paid Member Subscriptions
- Cozmoslabs (October 2026). Paid Member Subscriptions
- WordPress.org SVN. Paid Member Subscriptions 3.1.1, Stripe Connect gateway source
- WordPress.org (closed February 1, 2025). ARMember
- ARMember (October 2026). Pricing
- WordPress.org (October 2026). SureMembers
- SureMembers (October 2026). Pricing
- SureCart (October 2026). Pricing
- WordPress.org (October 2026). Ultimate Member
- Ultimate Member (October 2026). Pricing
- Ultimate Member. Export / Import
- WPScan (June 29, 2023, updated July 3, 2023). Hacking Campaign Actively Exploiting Ultimate Member Plugin
- Wordfence, Chloe Chamberland (June 29, 2023). PSA: Unpatched Critical Privilege Escalation Vulnerability in Ultimate Member Plugin Being Actively Exploited
- Ultimate Member (July 2023). Security incident update and recommended actions
- CVE.org. CVE-2023-3460
- CVE.org. CVE-2026-12251
- BleepingComputer, Bill Toulas (March 5, 2026). WordPress membership plugin bug exploited to create admin accounts
- WordPress.org (October 2026). s2Member
- s2Member (October 2026). s2Member Pro
- Stripe Docs. Automate payment retries
- Service-Public.fr (2023). Résiliation « en 3 clics » : application et étapes
- Kirkland & Ellis (July 2025). Eighth Circuit Blocks FTC’s Click-to-Cancel Rule
- WordPress.org SVN. Kadence Memberships 4.0.4, restrictcontent.php (2% Stripe fee)
- CVE.org. CVE-2026-9273
- Patchstack (October 2026). Paid Member Subscriptions vulnerabilities
- Patchstack (October 2026). s2Member vulnerabilities
- CVE.org. CVE-2026-19423
- CVE.org. CVE-2026-1492
- MemberPress. Emails
LaFactory designs, builds and maintains WordPress and WooCommerce sites, member areas and subscriptions included. Talk to us about your WordPress project.