WordPress Profile email change is flawed but has an easy fix

[ThemesMatic]

Currently, when a user resets their email address in their make.wordpress.org profile it sends the email confirmation, however, when the user clicks the link in the confirmation it throws an error which displays it to the user leaving them unable to update their email. The error message reads as follows:

"You attempted to access the "Make WordPress" dashboard, but you do not currently have privileges on this site. If you believe you should be able to access the "Make WordPress" dashboard, please contact your network administrator."

The reason WordPress displays this error, is the URL sent in the email to the user is incorrect.
The current confirmation link sent to the user is structured:

https://make.wordpress.org/wp-admin/profile.php?newuseremail=123456etc

The correct structure is:

https://make.wordpress.org/wp-admin/user/profile.php?newuseremail=123456etc

its missing "/user/" before "profile.php"
By adding "/user/" to the link I was able to update my email which removes "pending email update" from the profile page.
Seems like an easy fix.

[swissspidy]

Hey there,

Thanks for your report and welcome to WordPress Trac! Please note that this place is for reporting bugs in WordPress core, and not the WordPress.org website. Bug reports for that should be reported on ​https://meta.trac.wordpress.org. It's likely that this issue was already reported there before, so make sure a similar ticket does not exist yet.

[ocean90]

Re-opening since this is a bug in core. send_confirmation_on_profile_email() uses admin_url() which should be self_admin_url().

Related: #35766

[ocean90]

In 38876:

Users: Use self_admin_url() for the email change confirmation link.

Prevents sending users to wp-admin/profile.php if they only have access to wp-admin/user/profile.php.

Props dave.pullig.
Fixes #38451.

[ThemesMatic]

You guys rock.
Glad I could help.