Wp-invites accepts wrong code

  • Resolved daviding

    (@daviding)


    7 years, 5 months ago

    I installed wp-invites on WordPress 4.8 (on a normal site, not a Buddypress site). I added a (six letter, no punctuation, all lower case) code manually. The invite code field shows up at wp-login.php?action=register .

    I also have the New User Approve plugin and visualCaptcha installed.

    A few hours later, I was surprised to receive a User Approval message (i.e. from New User Approve). On testing, I can leave the invite code field blank, or enter a wrong code, and New User Approve gets triggered.

    I turned off visualCaptcha, and the wp-invites seems to still not work. Do you have any suggestions for further diagnosis? Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author themaster5_07

    (@themaster5_07)

    @daviding Do you ever get the wrong invite code warning message when submitting the registration form?

    Thread Starter daviding

    (@daviding)

    @themaster5_07 Yes, the wrong invite code message does come up on the first attempt. It could be that a subsequent attempt succeeds. The number of requests coming through has gone down, but they still come through, possibly on second or third try.

    Plugin Author themaster5_07

    (@themaster5_07)

    I believe the issue to be related to the plugin New User Approve by Josh Harrison. After reading the first review:

    sudden spam flood
    By zorbon on April 18, 2017
    It’s now 5 WP versions behind. Apparently a vulnerability has been exposed and we are seeing a flood of registration spam. Not even captcha stops it so it must be messing interfering with anti spam measures.

    If Josh Harrison updates the plugin and fixes the vulnerability, then I will check compatibility.

    I have tested WP-Invites plugin and could not get a registration to go through without a valid code. Can you disable the New User Approve plugin to see if the WP-Invites plugin is still giving your problems.

    Thread Starter daviding

    (@daviding)

    @themaster5_07 Thanks for the response.

    With the New User Approve plugin (and the visualCaptcha plugin) on, I tested the WP-Invites plugin, and registrations did go through without an invite code.

    With the WP-Invites plugin only, registrations do not go through without an invite code.

    With the WP-Invites plugin plus the visualCaptcha plugin, the registration process seems to work as it should.

    Without the New User Approve plugin, I’ve changed the New User Default Role to subscriber, so if anyone comes through, they shouldn’t be able to do any damage.

    I’m not sure that I really need the New User Approve plugin as this is a new site, so there may not be an urgency to worry about that.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Wp-invites accepts wrong code’ is closed to new replies.