The issue is related to email clients with a bug that misinterprets the Activation link {ARM_VALIDATE_URL} in e-mail account verification.
For example: https://www.mysite.com/login/?arm-key=GtSZR%25dA3M&email=email%40email.it => In the "arm-key," there is a URL-encoded value that breaks because when decoded, it contains the special character "%".
It seems that some email clients misinterpret the link and perform URL decoding when the link is clicked, resulting in the following link being sent to the browser: https://www.mysite.com/login/?arm-key=GtSZR%dA3M&email=email@email.it and then the browser performs URL decoding again.
The result is that when the activation link is clicked, it appears expired or invalid.
Changing line 2083 of file "class.arm_members.php" to "$activation_key = wp_generate_password(10 , false);" might resolve the error, perhaps.
1 year ago