Se requiere confirmación en el cambio de correo electrónico

Al igual que SickHippie, esta funcionalidad es nativa de WordPress pero solo para una configuración multisitio, por lo que aquí están las dos funciones que necesita para que esto funcione en una única configuración de sitio, que en su mayoría es código uno por uno del núcleo /wp-admin/user-edit.php file

function custom_send_confirmation_on_profile_email() {
    global $errors, $wpdb;
    $current_user = wp_get_current_user();
    if ( ! is_object($errors) )
        $errors = new WP_Error();

    if ( $current_user->ID != $_POST['user_id'] )
        return false;

    if ( $current_user->user_email != $_POST['email'] ) {
        if ( !is_email( $_POST['email'] ) ) {
            $errors->add( 'user_email', __( "<strong>ERROR</strong>: The e-mail address isn't correct." ), array( 'form-field' => 'email' ) );
            return;
        }

        if ( email_exists( $_POST['email'] ) ) {
            $errors->add( 'user_email', __( "<strong>ERROR</strong>: The e-mail address is already used." ), array( 'form-field' => 'email' ) );
            delete_user_meta( $current_user->ID . '_new_email' );
            return;
        }

        $hash = md5( $_POST['email'] . time() . mt_rand() );
        $new_user_email = array(
            'hash' => $hash,
            'newemail' => $_POST['email']
        );
        update_user_meta( $current_user->ID . '_new_email', $new_user_email );

        $content = apply_filters( 'new_user_email_content', __( "Dear user,

    You recently requested to have the email address on your account changed.
    If this is correct, please click on the following link to change it:
    ###ADMIN_URL###

    You can safely ignore and delete this email if you do not want to
    take this action.

    This email has been sent to ###EMAIL###

    Regards,
    All at ###SITENAME###
    ###SITEURL###" ), $new_user_email );

        $content = str_replace( '###ADMIN_URL###', esc_url( admin_url( 'profile.php?newuseremail='.$hash ) ), $content );
        $content = str_replace( '###EMAIL###', $_POST['email'], $content);
        $content = str_replace( '###SITENAME###', get_site_option( 'site_name' ), $content );
        $content = str_replace( '###SITEURL###', home_url(), $content );

        wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), get_option( 'blogname' ) ), $content );
        $_POST['email'] = $current_user->user_email;
    }
}
add_action( 'personal_options_update', 'custom_send_confirmation_on_profile_email' );

// Execute confirmed email change. See send_confirmation_on_profile_email().
function verify_email_change(){
    global $errors, $wpdb;
    $current_user = wp_get_current_user();
    if (in_array($GLOBALS['pagenow'], array('profile.php')) && $current_user->ID > 0) {
        if (isset( $_GET[ 'newuseremail' ] ) && $current_user->ID ) {
            $new_email = get_user_meta( $current_user->ID . '_new_email' );
            if ( $new_email[ 'hash' ] == $_GET[ 'newuseremail' ] ) {
                $user->ID = $current_user->ID;
                $user->user_email = esc_html( trim( $new_email[ 'newemail' ] ) );
                if ( $wpdb->get_var( $wpdb->prepare( "SELECT user_login FROM {$wpdb->users} WHERE user_login = %s", $current_user->user_login ) ) )
                    $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_email = %s WHERE user_login = %s", $user->user_email, $current_user->user_login ) );
                wp_update_user( get_object_vars( $user ) );
                delete_user_meta( $current_user->ID . '_new_email' );
                wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
                die();
            }
        } elseif ( !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' == $_GET['dismiss'] ) {
            delete_user_meta( $current_user->ID . '_new_email' );
            wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
            die();
        }
    }
}
add_action('plugins_loaded','verify_email_change');

Esta es una 'característica' extraña. La función está realmente disponible dentro de WordPress (WordPress.com la tiene habilitada para su servicio de blog administrado), pero está restringida a múltiples sitios. Si busca en /wp-admin/includes/ms.php encontrará la función que maneja esto: línea 239 send_confirmation_on_profile_email() .

Es de suponer que podría mover esta función a sus funciones.php o a un complemento para obtener esta funcionalidad, posiblemente con un poco de ajustes para que funcione correctamente. No responde al "por qué", pero tampoco el ticket de trac sobre este tema aquí .

ETA: más allá de esto, hay algunas otras funciones que quizás también necesite duplicar: new_user_email_admin_notice() y update_option_new_admin_email() saltan a ser posible.

La respuesta de Giri no funcionó para mí. Tuve que modificar el mío para que funcione (Wordpress 3.5)

function cleanup_verify_email_change()
{
    global $errors, $wpdb;
    $current_user = wp_get_current_user();

    // don't execute this if they're trying to dismiss a pending email change
    if (in_array($GLOBALS['pagenow'], array('profile.php')) && $current_user->ID > 0 & !isset($_GET["dismiss"])) 
    {
        if (isset( $_POST[ 'email' ] ) && ($current_user->user_email != $_POST['email']) ) 
        {
            $user->ID = $current_user->ID;
            $user->user_email = esc_html( trim( $_POST[ 'email' ] ) );

            if ( $wpdb->get_var( $wpdb->prepare( "SELECT user_login FROM {$wpdb->users} WHERE user_login = %s", $current_user->user_login ) ) ) {
                $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_email = %s WHERE user_login = %s", $user->user_email, $current_user->user_login ) );
            }

            wp_update_user( get_object_vars( $user ) );

            wp_redirect( add_query_arg( array('updated' => 'true', 'multisite_cleanup' => 'true'), self_admin_url( 'profile.php' ) ) );
            die();
        } 
        elseif ( !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' == $_GET['dismiss'] ) 
        {
            delete_user_meta( $current_user->ID . '_new_email' );
            wp_redirect( add_query_arg( array('updated' => 'true', 'multisite_cleanup' => 'true'), self_admin_url( 'profile.php' ) ) );
            die();
        }
    }
}
add_action('plugins_loaded','cleanup_verify_email_change');

He modificado el código Giri para que funcione en mi wordpress (versión 4.8.1+)

antes:

 update_user_meta( $current_user->ID . '_new_email', $new_user_email );

después de:

 update_user_meta( $current_user->ID, '_new_email', $new_user_email );

La coma necesita reemplazar el punto.

También:

$new_email['hash'];
$new_email['newemail'];

se convirtió en

$new_email[0]['hash'];
$new_email[0]['newemail'];

Por lo tanto:

function custom_send_confirmation_on_profile_email() {
    global $errors, $wpdb;
    $current_user = wp_get_current_user();
    if ( ! is_object($errors) )
        $errors = new WP_Error();

    if ( $current_user->ID != $_POST['user_id'] )
        return false;

    if ( $current_user->user_email != $_POST['email'] ) {
        if ( !is_email( $_POST['email'] ) ) {
            $errors->add( 'user_email', __( "<strong>ERROR</strong>: The e-mail address isn't correct." ), array( 'form-field' => 'email' ) );
            return;
        }

        if ( email_exists( $_POST['email'] ) ) {
            $errors->add( 'user_email', __( "<strong>ERROR</strong>: The e-mail address is already used." ), array( 'form-field' => 'email' ) );
            delete_user_meta( $current_user->ID, '_new_email' );
            return;
        }

        $hash = md5( $_POST['email'] . time() . mt_rand() );
        $new_user_email = array(
            'hash' => $hash,
            'newemail' => $_POST['email']
        );
        update_user_meta( $current_user->ID, '_new_email', $new_user_email );

        $content = apply_filters( 'new_user_email_content', __( "Dear user,

        You recently requested to have the email address on your account changed.
        If this is correct, please click on the following link to change it:
        ###ADMIN_URL###

        You can safely ignore and delete this email if you do not want to
        take this action.

        This email has been sent to ###EMAIL###

        Regards,
        All at ###SITENAME###
        ###SITEURL###" ), $new_user_email );

        $content = str_replace( '###ADMIN_URL###', esc_url( admin_url( 'profile.php?newuseremail='.$hash ) ), $content );
        $content = str_replace( '###EMAIL###', $_POST['email'], $content);
        $content = str_replace( '###SITENAME###', get_site_option( 'site_name' ), $content );
        $content = str_replace( '###SITEURL###', home_url(), $content );

        wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), get_option( 'blogname' ) ), $content );
        $_POST['email'] = $current_user->user_email;
    }
}
add_action( 'personal_options_update', 'custom_send_confirmation_on_profile_email' );

// Execute confirmed email change. See send_confirmation_on_profile_email().
function verify_email_change(){
    global $errors, $wpdb;
    $current_user = wp_get_current_user();
    if (in_array($GLOBALS['pagenow'], array('profile.php')) && $current_user->ID > 0) {
        if (isset( $_GET[ 'newuseremail' ] ) && $current_user->ID ) {
            $new_email = get_user_meta( $current_user->ID, '_new_email' );
            if ( $new_email[0]['hash'] == $_GET[ 'newuseremail' ] ) {
                $user->ID = $current_user->ID;
                $user->user_email = esc_html( trim( $new_email[0][ 'newemail' ] ) );
                if ( $wpdb->get_var( $wpdb->prepare( "SELECT user_login FROM {$wpdb->users} WHERE user_login = %s", $current_user->user_login ) ) )
                    $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_email = %s WHERE user_login = %s", $user->user_email, $current_user->user_login ) );
                wp_update_user( get_object_vars( $user ) );
                delete_user_meta( $current_user->ID, '_new_email' );
                wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
                die();
            }
        } elseif ( !empty( $_GET['dismiss'] ) && $current_user->ID . '_new_email' == $_GET['dismiss'] ) {
            delete_user_meta( $current_user->ID, '_new_email' );
            wp_redirect( add_query_arg( array('updated' => 'true'), self_admin_url( 'profile.php' ) ) );
            die();
        }
    }
}
add_action('after_setup_theme','verify_email_change');

Saludos.