Ticket #38432: 38432.2.patch

src/wp-includes/user.php

@@ -1803 +1803 @@
                 $user->set_role( $userdata['role'] );
         } elseif ( ! $update ) {
                 $user->set_role( get_option( 'default_role' ) );
+        } elseif( ( isset( $_GET['action'] ) ) && ( $_GET['action'] == "register" ) ) {
+                $user->set_role( '' );
         }
         wp_cache_delete( $user_id, 'users' );
         wp_cache_delete( $user_login, 'userlogins' );

src/wp-login.php

@@ -653 +653 @@
 
                 if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
                         list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
-                        $user                      = check_password_reset_key( $rp_key, $rp_login );
+                        $user = check_password_reset_key( $rp_key, $rp_login );
+                        // Get user form using WP_User query with user ID argument.
+                        $update_user = new WP_User( $user->ID );
+                        // Update default role for register user from admin side.
+                        $update_user->set_role( get_option( 'default_role' ) );
                         if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
                                 $user = false;
                         }