i go to my Registration page. fill out forms. AND use a totaly made up email.. xxty@ru4H9gx.com
"" Your registration was successful, you must confirm your email address before you can log in. Please check your email and click on the link provided."
without seeing the Verification email, i simply used my new credentials, and it logged in.
whats worse is, some poor guy who might have the email i used, now has access to the site. whitch means, the plugin does not check if it is a real email address. it just check that there is an "@" symbol followed by a .com at some point.
fix the ****.. we are paying for it.