Security: wrong login reveals registered users

@nils235

This issue has two sides: Password Reset and also User Registration, where an attempt to register with an email already registered will be rejected and user security is revealed with the message: “This email is already linked to an existing account”.

Registration with a duplicate email address should always be accepted with email activation where the email owner should have an alternative to reject the registration.

Read this article “Password reset email design best practices”:

https://postmarkapp.com/guides/password-reset-email-best-practices

You always send an email to the email address provided.

Your confirmation message displayed on the web page would simply say, “An email has been sent to (provided email address) with further instructions.” However, the content of that email changes based on whether a user exists with that email address:

If the user exists, you send your standard password reset email with a URL and instructions.
If the user doesn’t exist, you send a different email explaining that the user account was not found and suggesting that they try a different email address.

Valid comments here also:

https://security.stackexchange.com/questions/98082/forgot-password-and-revealing-whether-account-exists

• This reply was modified 4 years, 8 months ago by missveronica.
• This reply was modified 4 years, 8 months ago by missveronica.

@nils235

You can change the error message with the “Say What?” plugin.

Original string: We can't find an account registered with that address or username
Text domain: ultimate-member
Replacement string: Your error message without revealing the user

https://wordpress.org/plugins/say-what/

• This reply was modified 4 years, 8 months ago by missveronica.

@nils235

This code snippet removes the class names with “error”:

add_filter( "um_username_b_form_edit_field", "my_username_b_form_edit_field", 10, 2);

function my_username_b_form_edit_field( $output, $set_mode ) {

    if( $set_mode == 'password' ) {

        $output = str_replace( array( 'um-field-error', 'um-error'), array( 'um-field', '' ), $output );
    }
    return $output;
}

Install the code snippet in your child-theme functions.php file
or use the “Code Snippets” plugin

https://wordpress.org/plugins/code-snippets/