Users can switch to an arbitrary unregistered email address by editing the account

[coiby]

Describe the bug Users can switch to an arbitrary or even an fake email address by editing his/her account.

To Reproduce Steps to reproduce the behavior:

1. Go to My Account
2. Input an arbitrary email address
3. Hit "Update Account" button

Expected behavior We shouldn't allow an arbitrary email address .

Screenshots

[OSFOSF]

users could give a bad email address upon registration and need to change it and since only administrators and the user can change an email, it would be good too keep this as it is and allow users to change their own email address.

[coiby]

Personally, I think we should verify one's email address before activating the account in the first place for the following reasons,

1. We can make sure one one uses a bad email address or use other people's by mistake or intentionally
2. This can prevent users who forget their password from losing access by typing a invalid email address
3. This is consistent with users' expectation (I can't recall a website activating an account without verifying the email first)

[OSFOSF]

here is the code. where to put it? if (isset ($_POST['email'] ) { if ( email_exists($_POST['email'] ) ) {echo '

The email address is already used by another user

'; break;} if (filter_var($email, FILTER_VALIDATE_EMAIL)) { // echo "The email address '$email' is considered valid."; } else { echo "The email address '$email' is considered invalid."; break' } }

this code has been added to the user_update page but where to put it on the account page

[coiby]

There is no need to add above code because UM already prevent registered email address from being taken.

Btw, the UM has confirmed this bug is a missing feature and we can wait for them to fix.

[OSFOSF]

we could use never bounce to verify an email as valid but can not be automated and done in real time so it will have to be UM to fix any verifications. WP UM allows to send users an email verification but if email is bad no luck there.

where is a place where a new user can change email? hey no longer have access to user-update that willredirect to user profile and then thats up to UM