Auth0 WordPress Plugin Creates Username as Auth0 User ID Instead of Email Prefix

After upgrading the Auth0 WordPress plugin to version 5, the plugin creates newly provisioned WordPress accounts with the Auth0 user identifier instead of the expected email prefix. This occurs because the plugin discards unverified emails during the first login and falls back to the Auth0 identifier, which administrators resolve by blocking logins for unverified emails using a Post-Login Action. Specifically, the plugin creates a portion of new WordPress accounts with a hex-style username matching the Auth0 sub identifier instead of the email prefix of the user. The affected emails do not contain a plus sign or any other character that the WordPress sanitize_user() function strips. The plugin does not affect previously existing users.

• Auth0
• Auth0 WordPress Login Plugin (wp-auth0) version 5.x
• WordPress Account Provisioning

This is an intentional design change introduced in the Auth0 WordPress plugin version 5. In version 4, the plugin derived the WordPress username from the nickname or username fields returned by Auth0 in the userinfo response. Auth0 removed these fields from the username derivation logic in version 5 because they lack guaranteed uniqueness across connections. In version 5, the plugin derives the WordPress username from the local part of the verified email address of the user. If the email remains unverified at the time of the first login, the plugin discards the email entirely as a security measure to prevent account takeover through unverified email matching. The plugin then falls back to using the Auth0 sub-identifier as the WordPress user_login. Because the WordPress user_login remains immutable once the plugin creates it, affected accounts retain the hex-style username permanently.

How does Auth0 enforce the email prefix for new WordPress accounts?

Block logins for users with unverified emails at the Auth0 layer using a Post-Login Action to ensure the plugin generates all future WordPress accounts with a human-readable username derived from the email prefix. This guarantees that the user verifies the email before reaching WordPress for first-time provisioning. Create and deploy the email verification Post-Login Action from a template in the Auth0 Dashboard and add it to the Login flow.

1. In the Auth0 Dashboard, navigate to Actions, and then select Library.
2. Select Create Action and choose Choose from template.
3. Select the email-verified-POST_LOGIN template.
4. Deploy the action.
5. Add the deployed action to the Login flow.

How do administrators manage existing affected accounts?

NOTE: The WordPress user_login is immutable. Applying the Post-Login Action does not retroactively rename accounts that the plugin created with the Auth0 sub identifier as the username.

Update the display_name, first_name, last_name, or nickname fields in the WordPress user profile to provide a readable identifier for existing users. These fields remain mutable, unlike the user_login field.

How do administrators prevent this issue before upgrading?

Deploy the email-verified-POST_LOGIN action on the Login flow of every tenant before upgrading from the Auth0 WordPress plugin version 4 to version 5. This prevents any version 5 first-login from producing a sub-based username.