Password Reset Emails Wrongly Being Sent Out

  • I updated both S2Member and S2Member Pro to Version 150827 over the weekend. Today, I’ve been looking up users, adding a note, then saving the user. Several people have been emailed the standard ‘changed password’ email, which is clearly concerning them as it looks like someone has logged into their account. No passwords were changed by me when I logged into their user accounts. Here’s an example email received with confidential data replaced with xxxxxxxx…

    From: WordPress
    Date:01/09/2015 11:10 (GMT+00:00)
    To: xxxxxxxx
    Subject: [SIPPclub] Notice of Password Change

    Hi xxxxxxxx,

    This notice confirms that your password was changed on SIPPclub.

    If you did not change your password, please contact the Site Administrator at
    [email protected]

    This email has been sent to xxxxxxxx

    Regards,
    All at SIPPclub
    https://www.sippclub.com

    Please help as soon as possible, as I can’t now use my WordPress site for fear of worrying more clients.

    Thanks.

    Brian

    https://www.ads-software.com/plugins/s2member/

Viewing 8 replies - 1 through 8 (of 8 total)

  • I saw your message on GitHub this morning. As a Pro user, you are entitled to technical support. Please submit a trouble ticket on our support page. We will most likely need more information to help you solve your problem.

    Thanks in advance.

    Thread Starter bennisb

    (@bennisb)

    Thanks Patricia. I’ve now submitted a trouble ticket.

    My fingers are crossed it can be sorted quickly.

    Thanks.

    @bennisb, @patricia Dumond,

    I’m not clear if this is caused by the recent update of WordPress to 4.3, or whether it’s the way s2Member interacts with that change.

    Looking at the thread here, this seems to be the important info:

    That password change email is triggered any time that wp_update_user() is called with a user_pass argument. If the plugin is not actually changing the password, then they need to not update the user with a password field.

    This is because whether or not you change the password *to the same password*, the database will be changed. The same password can be hashed pretty much an infinite number of ways, so if you send it a user_pass, then it actually is rehashing it and updating the entry in the database.

    In the case of that thread, the plugin was clearly updating the password. What confuses me here is that, like @bennisb, I find that simply re-saving the user details in the WP admin creates the same problem, and I don’t know if s2Member has anything to do with that sort of action or not.

    In the case of that thread, the plugin was clearly updating the password. What confuses me here is that, like @bennisb, I find that simply re-saving the user details in the WP admin creates the same problem, and I don’t know if s2Member has anything to do with that sort of action or not.

    Raam Dev has replied to the issue over on GitHub that this is indeed caused by WordPress 4.3.

    @patricia Dumond,

    Not quite. The update to WP 4.3 is definitely a factor (and the cause of another issue he addresses there), but he hasn’t actually managed to reproduce this issue (yet?)

    I am having this issue.

    Every time I update any user, it is generating a password changed email and changing the password in some way.

    Has anyone made any progress on this?

    This is a WordPress issue, not an s2Member issue, and it’s affecting a lot more than just s2Member. The WP core devs have approved the solution submitted by the s2Member devs, though, so we are just waiting for the next update to WP.

    See also:
    – https://www.ads-software.com/support/topic/notice-of-password-change-email-every-time-user-profile-updated
    – https://github.com/websharks/s2member/issues/705

    Cristián

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Password Reset Emails Wrongly Being Sent Out’ is closed to new replies.