boonebgorges
commented
11 years ago Looks like there's been a longtime bug in the system, and the Welcome email getting sent just made it visible. Basically, when you have the create-a-WP-user flag turned on, the plugin runs a process where it attempts to find an existing WP user corresponding to your account (and if not, it creates one). But it looks like this process has always been run on every status change, including Pending and Rejected. I've changed it so that the plugin only attempts to do the WP-user-association when the new status is Accepted.
Changing a user's status to Rejected or Pending will send them a Welcome email with their username and password, namely:
Username: sashaobama
Forgot your password? http://testing.thatcampdev.info/wp-login.php?action=lostpassword
Log in: http://testing.thatcampdev.info/wp-login.php
A user should only get a Welcome email with their username and password when they are added as a user to the site.