www programming

Tested that with the fixed code all works as expected.
The user will be activated only after the correct reset of the password (when the confirmation link is sent).
If there is a wrong key or the link to activate/reset appear to be invalid, the user is not activated. Only at first login/reset pass will be activated into phpBB.

PS
Look that if it do not was for you, these bugs hardly could come out, because it is not so easy for me to test all possible features.
With you, we are at good point, 2.8.8 will be quite stable and 2.9.0 i assume will be quite perfect?
When (let name it) pro widgets
will be provided NOT for free, you'll have by the way a free active membership here allowing you to download all the code.
The point is: when i will do this part? Soon i hope!

[EDITED]

I have tested 2 scenarios on my webpage after updating the class.wp.w3all-phpbb.php:

Test 1: W3All Setting: Add users in phpBB only after first successful login in WordPress - NO

I registered a new user via WordPress. After submitting the registration, I attempted to log in directly without using the activation code. The user logged in without any issues and was fully operational. The WordPress Admin Control Panel (ACP) shows "Waiting for activation confirmation."

This is the worst-case scenario for me because any bot can register instantly and post in the forum without any authentication.

Test 2: Add users in phpBB only after first successful login in WordPress - Yes

I registered a new user via WordPress. After submitting the registration, I attempted to log in directly without using the activation code. However, I was unable to log in.

The user was not added to phpBB.

After using the activation code from the email, I was able to log in to WordPress, but the user did not appear in phpBB. it wasn't possible to use the forum.
-----------------------

What works perfect for me, is the old code with Add users in phpBB only after first successful login in WordPress - Yes

Because the user isn't able to login to phpbb and Wordpress an as soon as the user login to wp the user is full operational in phpbb as well.

I registered a new user via WordPress. After submitting the registration, I attempted to log in directly without using the activation code. The user logged in without any issues and was fully operational. The WordPress Admin Control Panel (ACP) shows "Waiting for activation confirmation."

Sorry, how you login in WP if you do not know the password at the registration time, and it need to be set after, when the email link is sent and clicked?
Are you using a front end registration form or a registration form where the user can choose the pass and not the WP default?
There is something maybe i do not have well focused!?

[EDITED]

Front-End registration via Wordpress - Ultimate-Members Plugin

https://surferparadise.de/register/

It let to choose the pass?

Yes ok, clear what's the problem. Let see for a fix for external plugins that let to choose the pass.
It is a well know old "paradigma"

[EDITED]

But like I wrote:

What works perfect for me, is the old code with Add users in phpBB only after first successful login in WordPress - Yes

Because the user isn't able to login to phpbb and Wordpress an as soon as the user login to wp the user is full operational in phpbb as well.

If there is no issue in the code, you should you consider to change the description of Add users in phpBB only after first successful login in WordPress

Add users in phpBB only after first successful login in WordPress

Note: if the option below
- Deactivate phpBB user account until WP confirmation
is set to Yes, then the user will be added into phpBB after using the activation link or confirmation by the admin

Note: may activating this option, you'll have to allow user's logins as mandatory only into WordPress, or the user that try to login in phpBB, will fail until not created in phpBB due to an explicit and successful login into WordPress

This option affect/work both default WordPress and WP Multisite installations, where there are signups registrations processes, but also will work for any plugin that use signups processes for user's registration into front-end

Note that if some frontend plugin, after the user's account confirmation action, allow the user's autologin via some option, may the autologin after confirmation will fail and the user will have to login by the way