v2.9.25

📋 Draft Tweet (copy to X — add emoji bullets as needed)

WP User Manager 2.9.25 Released 🚀

📝 WP User Manager v2.9.25

• Security: "Prevent site access to visitors" can no longer be bypassed with a URL that only looks like a REST API request (thanks to Truebird via Patchstack for responsible disclosure)
• Security: With site access prevented, the password reset page's child pages are no longer open to visitors
• Fix: With plain permalinks and site access prevented, REST API requests such as the Stripe webhook are no longer redirected to the login page

https://wpusermanager.com/

---

What's Changed

• Site lock: a URL that only looks like a REST request no longer skips it by @polevaultweb in #488
• Release 2.9.25 by @polevaultweb in #489
• Release 2.9.25 by @polevaultweb in #491

Full Changelog: v2.9.24...v2.9.25