Matching-mode user_register suppression also blocks the new user's own set-password email #8

New issue

Closed

opened 2026-10-16 21:07:23 -07:00 by eric · 0 comments

eric commented

2026-10-16 21:07:23 -07:00

Owner

Found during security audit run 3 (2026-10-16). This is a functional bug, not a security issue.

Problem

In matching email-suppression mode, when user_register is enabled, suppress_matching_events() suppresses both new-user emails (includes/class-apprise-email-suppressor.php:92-95):

add_filter( 'wp_send_new_user_notification_to_admin', '__return_false' );
add_filter( 'wp_send_new_user_notification_to_user', '__return_false' );

The Apprise user_register notification goes only to the site operator. Suppressing _to_user also blocks the new user's own welcome / set-password email, so a newly registered user never gets their login link. They have to find the lost-password flow on their own.

Fix

Suppress only wp_send_new_user_notification_to_admin. That is the email the Apprise notification replaces.
Update the setting's help text and readme if they describe this behaviour.
Test: in matching mode with user_register on, the _to_admin filter returns false and the _to_user filter is not registered.

Found during security audit run 3 (2026-10-16). This is a functional bug, not a security issue. ## Problem In `matching` email-suppression mode, when `user_register` is enabled, `suppress_matching_events()` suppresses both new-user emails (`includes/class-apprise-email-suppressor.php:92-95`): ```php add_filter( 'wp_send_new_user_notification_to_admin', '__return_false' ); add_filter( 'wp_send_new_user_notification_to_user', '__return_false' ); ``` The Apprise `user_register` notification goes only to the site operator. Suppressing `_to_user` also blocks the **new user's own** welcome / set-password email, so a newly registered user never gets their login link. They have to find the lost-password flow on their own. ## Fix - Suppress only `wp_send_new_user_notification_to_admin`. That is the email the Apprise notification replaces. - Update the setting's help text and readme if they describe this behaviour. - Test: in matching mode with `user_register` on, the `_to_admin` filter returns false and the `_to_user` filter is not registered.

eric added the

bug

label

2026-10-16 21:07:23 -07:00

eric referenced this issue from a commit

2026-10-16 21:26:30 -07:00

test: add wp-env integration suite

eric referenced this issue from a commit

2026-10-16 22:00:52 -07:00

fix: matching-mode user_register suppression keeps the new user's email

eric closed this issue

2026-10-16 22:00:52 -07:00