Membership Plugin

WordPress Membership Plugin

[Resolved] Password reset link can’t be disabled

Simple Membership Plugin › Forums › Simple Membership Plugin › Password reset link can’t be disabled

Tagged: ,

Viewing 3 posts - 1 through 3 (of 3 total)
  • Author
    Posts
  • November 9, 2024 at 4:29 am #29063
    Desty
    Participant

    The password reset link feature doesn’t require an email confirmation — that is, if a user knows any other user’s email address, they can reset their password at any time.
    This opens it up for abuse, so I tried to disable it by unchecking the “Enable Password Reset Using Link” in SWPM settings. However, it appears to have made no difference, and I was able to reset my test user’s password.

    For now I’ve just deleted the shortcode from the generated password reset form page, but the login form still contains a link to it. Is there an easy way to remove this?

    November 10, 2024 at 12:27 am #29065
    The Assurer
    Moderator

    You have the option of emailing a reset link, that must be clicked; which is sent to the email address.
    https://simple-membership-plugin.com/password-reset-notification-email-customization/

    If the alleged victim does not click the link… nothing happens.

    November 11, 2024 at 8:07 pm #29072
    Desty
    Participant

    Ah, then I just totally misunderstood that option, my bad.
    I will probably leave it off until there’s more activity on the site, then buy the captcha plugin and enable the reset link option.

    Thanks for explaining!

  • Author
    Posts
Viewing 3 posts - 1 through 3 (of 3 total)
  • You must be logged in to reply to this topic.