In the email settings we have the following:

Your password for the NNNNN Members' Area has been reset.

Your new password is included below. You may wish to retain a copy for your records.

password: [password]

You can log in here: https://NNNNNN.com/members-area/ 

Once logged in, you can change your password here: [user-profile]

The user profile short code seems to work ok. But where the password should be in the email, we have nothing, not even white space.

However, I am unable to customize this page to align with the branding of my other pages. I couldn’t find a shortcode or a way to change the layout and design of this reset password form. Could you please guide me on how to customize this page? Is there a way to use a shortcode or a custom template for it?

The reset password key is currently too long and difficult for users to manage. It would be helpful to simplify the process by making the key shorter and easier to use, reducing confusion for users.

Here’s a screenshot for reference: https://prnt.sc/ZZ__hddXJkNc

Looking forward to your response.

Thanks!

I’ve noticed that users can reset their passwords with just a single character, which is a security risk. There should be a validation check to enforce a minimum password length and other security requirements. Please review this issue and implement a fix.

Screenshot for reference: https://prnt.sc/DaNiDzvm0bCQ

Looking forward to your response.

Thanks!

I have been using Tutor LMS Pro and noticed that it does not provide a built-in email template for password reset emails. While other email notifications are customizable within the plugin, the password reset email seems to rely on the default WordPress email template.

Is there any way to customize the password reset email specifically for Tutor LMS users? If not, are there any recommended workarounds or third-party plugins that integrate well with Tutor LMS for this purpose?

Any guidance on this would be greatly appreciated.

Thanks!

Now, when you plugin sends the first message to the user, the Login link and the Password reset link are not working at all because they are pointing to wp-login, that doesn’t exist any more.

LoginWP is not an option. It must be there to make its job.
But perhaps you can solve this issue when LoginWP is installed.

On top of this, when an email is sent, the recipient receives it from “wordpress” instead of from the Site Title.

WP 6.7.1
LoginWP 3.0.8.6

What we’d like is to ensure that in addition to sending the password reset email only to an address known to the site, that such email is sent only for accounts that are already approved. I’ve examined the code to that end, and found function um_reset_password_process_hook() in includes/core/class-password.php, where on my test site I’ve made the following change:

--- includes/core/class-password.php.20241206   2024-04-09 20:20:26.000000000 -0300
+++ includes/core/class-password.php    2024-12-06 11:10:12.962327061 -0400
@@ -448,11 +448,13 @@ if ( ! class_exists( 'um\core\Password'
 
                        if ( username_exists( $user ) ) {
                                $data = get_user_by( 'login', $user );
+                               $user_id = username_exists( $user );
                        } elseif ( email_exists( $user ) ) {
                                $data = get_user_by( 'email', $user );
+                               $user_id = email_exists( $user );
                        }
 
-                       if ( isset( $data ) && is_a( $data, '\WP_User' ) ) {
+                       if ( isset( $data ) && is_a( $data, '\WP_User' && UM()->user()->is_approved( $user_id ) ) ) {
                                um_fetch_user( $data->ID );
                                UM()->user()->password_reset();
                        }

The above passes basic sanity testing, but as I’m not a WordPress developer (nor even an PHP programmer), I certainly do imagine that there might be a more elegant way to implement the additional check.

My question for the support forum is How would I go about submitting this change to the Ultimate Member developers, so that they might consider incorporating it into the plugin (perhaps even having it be a configurable option)? I can imagine that ours is not the only site where it simply doesn’t make sense to send password reset emails for accounts that have not yet been approved.

With that, I thank the relevant folks for making the plugin available, and I do hope that my modification above will be seen as a potential improvement.