diff --git src/bp-members/classes/class-bp-signup.php src/bp-members/classes/class-bp-signup.php
index 339e00c2c..9cd7d6e2e 100644
--- src/bp-members/classes/class-bp-signup.php
+++ src/bp-members/classes/class-bp-signup.php
@@ -121,13 +121,15 @@ class BP_Signup {
 	 * Fetch signups based on parameters.
 	 *
 	 * @since 2.0.0
+	 * @since 6.0.0 Adds a whitelist of allowed orderby parameters.
 	 *
 	 * @param array $args {
 	 *     The argument to retrieve desired signups.
 	 *     @type int         $offset         Offset amount. Default 0.
 	 *     @type int         $number         How many to fetch. Default 1.
 	 *     @type bool|string $usersearch     Whether or not to search for a username. Default false.
-	 *     @type string      $orderby        Order By parameter. Default 'signup_id'.
+	 *     @type string      $orderby        Order By parameter. Possible values are `signup_id`, `login`, `email`,
+	 *                                       `registered`, `activated`. Default `signup_id`.
 	 *     @type string      $order          Order direction. Default 'DESC'.
 	 *     @type bool        $include        Whether or not to include more specific query params.
 	 *     @type string      $activation_key Activation key to search for.
@@ -158,8 +160,12 @@ class BP_Signup {
 			'bp_core_signups_get_args'
 		);
 
-		// @todo whitelist sanitization
-		if ( $r['orderby'] !== 'signup_id' ) {
+		// Whitelist sanitization.
+		if ( ! in_array( $r['orderby'], array( 'login', 'email', 'registered', 'activated' ), true ) ) {
+			$r['orderby'] = 'signup_id';
+		}
+
+		if ( 'login' === $r['orderby'] || 'email' === $r['orderby'] ) {
 			$r['orderby'] = 'user_' . $r['orderby'];
 		}
 
diff --git tests/phpunit/testcases/members/class-bp-signup.php tests/phpunit/testcases/members/class-bp-signup.php
index 2507d25cc..4a420d414 100644
--- tests/phpunit/testcases/members/class-bp-signup.php
+++ tests/phpunit/testcases/members/class-bp-signup.php
@@ -195,6 +195,56 @@ class BP_Tests_BP_Signup extends BP_UnitTestCase {
 		$this->assertEquals( array( $s2, $s1, $s3 ), $ss['signups'] );
 	}
 
+	/**
+	 * @group get
+	 */
+	public function test_get_with_orderby_login_asc() {
+		$s1 = self::factory()->signup->create( array(
+			'user_login' => 'fghij',
+		) );
+		$s2 = self::factory()->signup->create( array(
+			'user_login' => 'abcde',
+		) );
+		$s3 = self::factory()->signup->create( array(
+			'user_login' => 'zzzzz',
+		) );
+
+		$ss = BP_Signup::get( array(
+			'orderby' => 'login',
+			'number' => 3,
+			'order' => 'ASC',
+			'fields' => 'ids',
+		) );
+
+		$this->assertEquals( array( $s2, $s1, $s3 ), $ss['signups'] );
+	}
+
+	/**
+	 * @group get
+	 */
+	public function test_get_with_orderby_registered_asc() {
+		$now = time();
+
+		$s1 = self::factory()->signup->create( array(
+			'registered' => date( 'Y-m-d H:i:s', $now - 50 ),
+		) );
+		$s2 = self::factory()->signup->create( array(
+			'registered' => date( 'Y-m-d H:i:s', $now - 100 ),
+		) );
+		$s3 = self::factory()->signup->create( array(
+			'registered' => date( 'Y-m-d H:i:s', $now - 10 ),
+		) );
+
+		$ss = BP_Signup::get( array(
+			'orderby' => 'registered',
+			'number' => 3,
+			'order' => 'ASC',
+			'fields' => 'ids',
+		) );
+
+		$this->assertEquals( array( $s2, $s1, $s3 ), $ss['signups'] );
+	}
+
 	/**
 	 * @group get
 	 */