User locked out of account on saving new email

Bug Reports
1

Hi

I noticed that if a user saves an erroneous new email address, he will be locked out of his account

STEPS

  1. Go to your user account settings
  2. Set a new email address. Imagine you want to set john@gmail.com, but you write johnn@gmail.com
  3. System asks for password before saving. Insert correct password
  4. New (wrong) email is saved
  5. Verification email sent to wrong email address

RESULT

  1. If user logs out without noticing mistake, he can’t enter with old email address because system alerts that he needs to verify the new email address
  2. User is unable to verify new address because system email was sent to wrong one
  3. User is locked out

EXPECTED BEHAVIOR
Before saving new email address, verify first via system verification email, then save.

Hope this can be solved soon!

2

I haven’t tested this, but nice catch!

5

Thanks for reporting this issue. Please let me know if the user is logged out automatically after this, if not then a temporary workaround is changing the email back (since the current password is the same).

We’ll also add some kind of cancellation option to revert the email address to the next HivePress core update.

7

Hi

no, the user is not logged out automatically. If he notices the wrong email, he can still set it back. The issue happens when he changes the email to a wrong one and then logs out himself, he will not get back in

9

Thanks for the details, we’ll check how WordPress resolves this issue in their core password reset process and fix this in the next HivePress core update.