Multi-site user registration disabled after WordPress V7.0.5/V7.0.6

Multi-site user registration disabled after WordPress V7.0.5/V7.0.6.

Here is an AI analysis (take with a grain of salt as always…)

The Problem: Why v7.0.5+ Ignores the Patches

To map custom registration fields into a Multisite network, s2Member Pro requires writing literal replacement code blocks into core engine files. If you look at your WordPress Dashboard → s2Member Pro → Multisite (Config) panel, you will see it relies on an automated patcher that edits four core system tracks: [1]

  1. /wp-login.php
  2. /wp-admin/user-new.php
  3. /wp-includes/load.php
  4. /wp-includes/ms-functions.php [1]

What WordPress v7.0.5 and v7.0.6 changed:

  • File Strictness & Overwrite Handling: WordPress updated ms-functions.php and load.php to address high-priority multisite registration exploits. These security hardening fixes completely rewrote the internal conditional loops surrounding wpmu_validate_user_signup() . [1]
  • The Breakage: Because WordPress physically altered the structural source lines within ms-functions.php , the exact “string matches” that s2Member Pro searches for to inject its custom field handling code are gone. When s2Member tries to apply its dynamic file patches, the target strings fail to match, causing WordPress to ignore s2Member’s routines and fall back entirely to standard, unpatched behavior.

Because s2Member’s overrides are ignored, your custom fields disappear from native multi-site screens, or sub-site registration gets cut off entirely.

How to Fix It (And Save Your Extended Registration Fields)

You do not need to manually hack your core files every time WordPress updates. Instead, use a stable approach to bypass the broken file patcher while fully preserving your s2Member Pro extended registration data.

Step 1: Force s2Member Pro to Use Shortcodes (The Pro-Form Method)

Instead of forcing users to register via the native WordPress /wp-signup.php or sub-site /wp-login.php?action=register URLs (which require the broken core patches), route your registrations through a dedicated page using s2Member Pro-Forms . [1, 2]

  1. Create a normal WordPress Page on your network (e.g., “Register”).
  2. Insert the s2Member Pro-Form shortcode matching your registration level (e.g., Level 0 for free or Level 1+ for paid):

wordpress

[s2Member-Pro-PayPal-Form register="1" level="0" desc="Sign Up Here" ps="paypal" lc="" cc="" dg="0" ns="1" custom="yourdomain.com" ta="0" tp="0" tt="0" ra="0" rp="0" rt="0" rr="0" rrt="" rra="1" /]

Use code with caution.

(If you use Stripe or another gateway, use the respective Pro-Form shortcode). [1, 2, 3, 4]
3. Why this works: s2Member Pro-Forms completely bypass the native WordPress registration screens. They render their own form arrays, automatically pulling in every custom field you defined under s2Member > General Options > Registration/Profile Fields & Options without relying on the broken core file patches! [1, 2]

Step 2: Redirect Native Registrations

To prevent users or the network from hitting the broken native files, force all registration traffic to your new Pro-Form page. Add this small drop-in function to your main theme’s functions.php file, or save it as a file in your /wp-content/mu-plugins/ directory:

<?php
// Redirect native multisite registration to your s2Member Pro-Form page
add_action('init', 'redirect_native_multisite_registration');
function redirect_native_multisite_registration() {
    global $pagenow;
    
    // Check if user is trying to access the native signup script
    if ($pagenow === 'wp-signup.php') {
        // Change this URL to your actual s2Member Pro-Form registration page
        wp_redirect(home_url('/register/'));
        exit();
    }
}

Hi Tim.

Thanks for reporting this and for the detailed analysis.

I investigated it. The WordPress 7.0.5/7.0.6 changes don’t appear to have broken the actual code patterns that s2Member patches. What I did find was a longstanding edge case in how s2Member reapplied those patches after WordPress core updates: automatic/background updates could replace the patched files without s2Member reliably patching them again.

I’ve fixed that now. I also hardened the patcher so that already-patched files aren’t unnecessarily rewritten when it runs again.

I did tests for the whole flow, including automatic core-update handling, repeated patching, and files that can’t be verified. That’s all passing now.

The fix will be included in the next release.

:slight_smile:

@clavaque - you are the champ :slight_smile: Do you know when you expect your next release to go out? This is impacting one of my large clients so they will ask me. Not pushing :slight_smile:

I can’t thank you enough for this quick turn-around. Very, very much appreciated :slight_smile:

2 Likes

I should have said…one of your large clients…they purchased the pro license directly from you…the license is in their name…I just manage their site for them.

1 Like

Very soon! But I sent you the dev builds in a private message so you can have it sooner.

:slight_smile:

Cheers @clavaque - you are the best :slight_smile: Very much appreciated :slight_smile:

1 Like
  • (Pro) Fix: Improved legacy Multisite Membership-Only registration after WordPress core updates. s2Member now restores its required patches after successful automatic/background upgrades, while avoiding unnecessary rewrites when files are already patched. Thanks to Tim for reporting the issue. See thread #13641.

:slight_smile:

2 Likes