- This topic has 6 replies, 3 voices, and was last updated 6 years, 6 months ago by
.
-
Posts
-
Hi,
Today we went live and started accepting members using the simple membership plugin (of course).
However, we did notice a weird issue. One of the administrator users lost the ability to login. When he visited the login screen, he noticed a username that was associated with a newly registered user (via the membership plugin).
After further investigation in the backend DB, I noticed that each user that registered using the simple membership plug in had a corresponding username under WP Users. Note: the options “Force WP User Synchronization” and “Enable Auto Create Member Accounts” are NOT enabled. Is this normal behaviour?
For reference we are using the following setup.
– WP 5.2.4
– Simple Membership Plugin
– Form Builder Add on
– Custom Messages
– WP Super Cache (the cache restriction ” Disable caching for logged in visitors” is enabledWe are also using the free tier account of Cloudflare for additional caching.
Is there a chance that this mishap could be a caching issue? Is there any special recommendation setup for Cloudflare?
Kind Regards,
GeorgiosHi,
After further investigation in the backend DB, I noticed that each user that registered using the simple membership plug in had a corresponding username under WP Users. Note: the options “Force WP User Synchronization” and “Enable Auto Create Member Accounts” are NOT enabled. Is this normal behaviour?
Yes.
Simple membership plugin works with WP Users. Each time a new member is added to your site they will also have a corresponding WP User account created. Which means that when they log into your sites members area, they will also get logged in as a WP user automatically.
Let me know if you need more information or help.
Thank you
I’ve hit this issue today by accident, luckily during site testing. Indeed, the WP Membership plugin username can be the same as one of the “original” members, and what happens then is that the master admin user (the username that was “over-ridden”) has his user level switched from Administrator to a lower level Subscriber. What follows when you try to login as an Admin, the main site blocks you out, because you don’t have the dashboard login rights (and you won’t be able to login to the plugin as well, since you don’t exist as an admin user there).
To put it simply, the WP Members plugin should also check and prevent double usernames and e-mails not only within itself, but out of the main wpip_users table, else this is a potential security risk where admins can be locked out because of user errors (or intentionally).
Please solve this issue.
Hi,
Indeed, the WP Membership plugin username can be the same as one of the “original” members, and what happens then is that the master admin user (the username that was “over-ridden”) has his user level switched from Administrator to a lower level Subscriber.
The membership plugin will not create a duplicate username or email address if there is a WP User already using them. Can you provide step by step instructions on how you created a member in the membership plugin that was already added to WP Users?
Thank you
It will happen during the new member registration phase (after completing a payment via the activation link that is sent by an email) and I can easily do the same via Simple WP Membership -> Add Member (when manually entering a username).
The issue is that, if I have an admin named “test” with an e-mail address test@test.com, and a member would try to register the same username (which currently does work that way), the WP plugin user will be successfully created, but also, the admin’s e-mail will be replaced with say “member@member.com”, which came from the member registration form and his user role will be changed from administrator to subscriber.
This happens with or without the “Force WP User Synchronization” option. The WordPress is a standard installation, apart from the WP Members plugin, I’m also using WooCommerce, but with no members/buyers (only for internal listings, no checkouts, purchases etc).
Forgot to add that I’m also using the “Membership Form Builder Addon”, but the described issue was happening without it as well.
@vborovic I have submitted a message to the developers to investigate further your issue.
Thank you
It would also be a good idea to somehow implement a white/blacklist feature for the usernames and email addresses, which should be blocked from using during customer/subscriber registration and later account updating (i.e “admin”, “administrator”, info@domain.com, admin@domain.com etc.)
- You must be logged in to reply to this topic.