WP CRM Sent 1000’s of rogue emails for no reason

Here is a forwarded message I received from one on the realtors:

”
———- Forwarded message ———
From: WordPress <wordpress@oahurealtypro.com>
Date: Fri, Jan 8, 2021 at 10:40 AM
Subject: [Oahu Realty Pro] Email Changed
To: <???????@????????.com> I added ‘?’ to protect the innocent. (rj)

Hi 3476269, This notice confirms that your email address on Oahu Realty Pro was changed to ????????@???????hawaii.com. If you did not change your email, please contact the Site Administrator at russ@pcnllc.net This email has been sent to ?????@??????hawaii.com Regards, All at Oahu Realty Pro https://www.oahurealtypro.com
”

Every realtor in the MLS system got this after I used your WP ERP – CRM Module >> import Users function. I selected a user category that has only 2, two, users in it. Yet, your plugin imported and sent emails to 57,000 realtors.

The instructions aren’t even written in English. what does “Selected user role are considered for import” mean? What is that? What does that function do? I thought it meant that only the selected categories would be imported. I NEVER expected that your plugin would send BS emails to 57,000 people without a confirmation step.

@thebengalboy

I reached out to your organization several times for a few days via several different methods. I had no response from your organization during that time. I finally posted something here and the wp support forum in hopes that you would respond and at least attempt to help. My dashboard on your site still states, “No support conversation found !” as of this writing.

As you and I discussed, your plugin caused WP to send these emails. You have admin rights to my site; the log shows that nothing else was going on other than your Import User routine – which I had only selected 2 test users to import. At that time, your plugin imported everyone in my database (which is a bug in your code) did an operation that triggered WordPress to send the messages. Please review your code to see what operation you are performing to trigger WordPress to send an email that says:
“This notice confirms that your email address on [site name] was changed to ????????@???????hawaii.com.”

The WP code is fairly simple and triggers an email to be sent if the email address has been changed. The emails in the messages that your plug triggered had not been changed. Not one. They are all the same as they have been for weeks. The WP email_change_email code is triggered when the email address of a user has changed or when your plugin does something in the user email field that WP thinks is a change. The WP email_change routine calls the password change email notification routine and modifies the array to be used for the email change message.

$pass_change_email = array(
‘to’ => $user[‘user_email’],
/* translators: Password change notification email subject. %s: Site title. */
‘subject’ => __( ‘[%s] Password Changed’ ),
‘message’ => $pass_change_text,
‘headers’ => ”,
);

/**
* Filters the contents of the email sent when the user’s password is changed.
*
* @since 4.3.0
*
* @param array $pass_change_email {
* Used to build wp_mail().
*
* @type string $to The intended recipients. Add emails in a comma separated string.
* @type string $subject The subject of the email.
* @type string $message The content of the email.
* The following strings have a special meaning and will get replaced dynamically:
* – ###USERNAME### The current user’s username.
* – ###ADMIN_EMAIL### The admin email in case this was unexpected.
* – ###EMAIL### The user’s email address.
* – ###SITENAME### The name of the site.
* – ###SITEURL### The URL to the site.
* @type string $headers Headers. Add headers in a newline (\r\n) separated string.
* }
* @param array $user The original user array.
* @param array $userdata The updated user array.
*/
$pass_change_email = apply_filters( ‘password_change_email’, $pass_change_email, $user, $userdata );

$pass_change_email[‘message’] = str_replace( ‘###USERNAME###’, $user[‘user_login’], $pass_change_email[‘message’] );
$pass_change_email[‘message’] = str_replace( ‘###ADMIN_EMAIL###’, get_option( ‘admin_email’ ), $pass_change_email[‘message’] );
$pass_change_email[‘message’] = str_replace( ‘###EMAIL###’, $user[‘user_email’], $pass_change_email[‘message’] );
$pass_change_email[‘message’] = str_replace( ‘###SITENAME###’, $blog_name, $pass_change_email[‘message’] );
$pass_change_email[‘message’] = str_replace( ‘###SITEURL###’, home_url(), $pass_change_email[‘message’] );

wp_mail( $pass_change_email[‘to’], sprintf( $pass_change_email[‘subject’], $blog_name ), $pass_change_email[‘message’], $pass_change_email[‘headers’] );
}

if ( ! empty( $send_email_change_email ) ) {
/* translators: Do not translate USERNAME, ADMIN_EMAIL, NEW_EMAIL, EMAIL, SITENAME, SITEURL: those are placeholders. */
$email_change_text = __(
‘Hi ###USERNAME###,

This notice confirms that your email address on ###SITENAME### was changed to ###NEW_EMAIL###.

If you did not change your email, please contact the Site Administrator at
###ADMIN_EMAIL###

This email has been sent to ###EMAIL###

Regards,
All at ###SITENAME###
###SITEURL###’
);

$email_change_email = array(
‘to’ => $user[‘user_email’],
/* translators: Email change notification email subject. %s: Site title. */
‘subject’ => __( ‘[%s] Email Changed’ ),
‘message’ => $email_change_text,
‘headers’ => ”,
);

/**
* Filters the contents of the email sent when the user’s email is changed.
*
* @since 4.3.0
*
* @param array $email_change_email {
* Used to build wp_mail().
*
* @type string $to The intended recipients.
* @type string $subject The subject of the email.
* @type string $message The content of the email.
* The following strings have a special meaning and will get replaced dynamically:
* – ###USERNAME### The current user’s username.
* – ###ADMIN_EMAIL### The admin email in case this was unexpected.
* – ###NEW_EMAIL### The new email address.
* – ###EMAIL### The old email address.
* – ###SITENAME### The name of the site.
* – ###SITEURL### The URL to the site.
* @type string $headers Headers.
* }
* @param array $user The original user array.
* @param array $userdata The updated user array.
*/
$email_change_email = apply_filters( ’email_change_email’, $email_change_email, $user, $userdata );

$email_change_email[‘message’] = str_replace( ‘###USERNAME###’, $user[‘user_login’], $email_change_email[‘message’] );
$email_change_email[‘message’] = str_replace( ‘###ADMIN_EMAIL###’, get_option( ‘admin_email’ ), $email_change_email[‘message’] );
$email_change_email[‘message’] = str_replace( ‘###NEW_EMAIL###’, $userdata[‘user_email’], $email_change_email[‘message’] );
$email_change_email[‘message’] = str_replace( ‘###EMAIL###’, $user[‘user_email’], $email_change_email[‘message’] );
$email_change_email[‘message’] = str_replace( ‘###SITENAME###’, $blog_name, $email_change_email[‘message’] );
$email_change_email[‘message’] = str_replace( ‘###SITEURL###’, home_url(), $email_change_email[‘message’] );

wp_mail( $email_change_email[‘to’], sprintf( $email_change_email[‘subject’], $blog_name ), $email_change_email[‘message’], $email_change_email[‘headers’] );
}

if ( $switched_locale ) {
restore_previous_locale();
}
}

I figured out what caused the problem. It was NOT your plugin. It was another routine that was running at the same time I was testing your import. WP ERP is solid.

Russ