What happens if a student changes their email in Thinkific or WordPress?

The answer to this question depends on where the student changes their email. At a high level, the Thinkific SSO plugin assumes the students email in WordPress is their email in Thinkific.


To create a login link, WordPress users the student email to create a secret token. This token is based on the email of the student and since the login starts in WordPress, the plugin assumes the same email exists in Thinkific. At this time, Thinkific only supports SSO by email, not the unique ID of a user in Thinkific.

So, what happens if they change their WordPress email?

If your student changes their email in WordPress and not in Thinkific, when they log in they will be directed to the account with that email in Thinkific. If an account for that email does not exist, an account will be created and any enrolments that had associated with their previous email will not carry over.

Note, there is an important consideration here for security. If a student changed their WordPress email to the email address of someone else in your Thinkific school, they can access that persons Thinkific account by simply clicking the login link presented to them in WordPress. This is not a bug, this is simply how SSO works as WordPress is being trusted to provide the authentication.

Ok, but what happens if a user changes their Thinkific email but not their WordPress email?

The same issue occurs but in reverse. When a user clicks login from WordPress they will be directed to the Thinkific account associated with their current WordPress email.

So, how can a student change their email?

I strongly recommend that you do not permit a user to change their email address in WordPress. If they require a change of email, they should contact you and as an admin, you should change the email address in both WordPress and Thinkfic. Do not permit students to change or update their WordPress or Thinkific emails by themselves.

Any other options?

At present, we are talking with Thinkific to see what we can do to mitigate this problem. We will update this post when we have more information.