Deactivation Approves All Users – SECURITY ISSUE

No, it is not.

Next time, try deleting or approving all pending users before deactivating the plugin.

If the users were pending, I would NOT expect them to auto-approve to active status. On a site with hundreds of users, the way you have it is a problem. It would be safer to delete all pending users on deactivation.

Hello, @obenland. Have you made or plan to make any adjustments in the default behavior regarding this issue?

I’m not planning to make any adjustments here. It is WordPress’ default behavior and to be expected when deactivating the plugin.

OK. Maybe a warning of what to expect upon deactivation could be useful, though. That way, users wouldn’t assume wrongly that deactivation won’t change what they have not explicitly allowed.

Best.

I agree with the other users here that this would be a nice feature to have. Maybe keeping the pending users as meta when deactivating, so once it is reactivated the pending users are all still pending. When the plugin is removed entirely ( deleted ) then it would go through the cleanup process of removing the metadata.

I guess I see deactivating as more of a temporary action where this plugin handles it as a permanent action.

Thanks, @howdy_mcgee. That’s actually the key of this misunderstanding: deactivating is temporary; uninstalling is permanent.

Temporarily deactivating plugins is a standard action while troubleshooting. Without even a warning, the site admin will never know of the potential dangers and -at the very least- complications ahead.

That’s actually the key of this misunderstanding: deactivating is temporary; uninstalling is permanent.

Agreed! I updated the activation callback to not overwrite existing meta values, which should fix that in version 8 of the plugin. Thanks for bearing with me.

Thanks, Konstantin.

Cheers.

Is this pushed live?

Every time I deactivate the plugin for testing/dev purposes, all users are automatically approved. I’ve auto-approved like 20 bots already.

Should I download and replace the files manually? Or is it live already and just not working as intended? This “bug” is pretty bad!

Thanks for the plugin by the way!

(MB, seems I’m on version 7. I didn’t get any message to update the plugin in the plugins menu. Guess I’ll reinstall manually via upload. Thanks!)

• This reply was modified 3 years, 8 months ago by whiteweazel21.

This “bug” is pretty bad!

Thanks for the plugin by the way!

What an emotional rollercoaster! ??
Thanks for the heads up, should be fixed now.