https://anchor.host/hijacking-bnfw-for-email-subscriptions/

bnfw-wp-freighter.php

<?php
/**
 * Plugin Name: BNFW WP Freighter Subscriber Addon
 * Plugin URI: https://wpfreighter.com
 * Description: Manage email subscriptions easily with BNFW
 * Version: 1.0.0
 * Author: Austin Ginder
 * Author URI: https://austinginder.com
 * Text Domain: bnfw-wp-freighter
 */

add_action( 'init', 'wp_freighter_subscription_management' );
add_action( 'init', 'wp_freighter_subscription_signup' );
add_action( 'gform_after_submission_1', 'wp_freighter_generate_email_subscriber', 10, 2 );
add_filter( 'bnfw_shortcodes_user', 'wp_freighter_bnfw_recipient_token_shortcode', 10, 3 );
add_filter( 'wp_mail', 'wp_freighter_bnfw_replace_mail' );

/**
 * Manage subscription to email newsletters
 */
function wp_freighter_subscription_management() {

	global $pagenow;

	// Hook into wp-signup.php page if arguments found
	if ( 'wp-signup.php' !== $pagenow || !isset( $_GET['id'] ) || !isset( $_GET['email'] ) || !isset( $_GET['token'] ) || !isset( $_GET['action'] ) ) {
		return;
	}

	$email         = $_GET['email'];
	$email_compare = "email-subscriber_$email";
	$home_url      = get_home_url();

	// Find user matching ID and email address.
	$user       = get_user_by( "ID", $_GET['id'] );
	$user_token = wp_hash( $user->user_registered );

	if ( !$user || $user->user_email != $email_compare || $_GET['token'] != $user_token ) {
		wp_die( "<p style='text-align:center'>Invalid email subscription token.</p>", "Manage subscription to email newsletters" );
	}

	$user_id    = $user->ID;

	if ( $_GET['action'] == "subscribe" ) {

		$user->add_role("email_subscriber");
		$html = <<<EOT
			<p style='text-align:center'>
				Your email <strong>$email</strong> has been subscribed. <br />
				<small>If that wasn't your intention the click here to <a href='${home_url}/wp-signup.php?id=${user_id}&email=${email}&token=${user_token}&action=unsubscribe'>unsubscribe</a></small>
			</p>
EOT;
		wp_die( $html, "Subscribe to email newsletters" );

	}

	if ( $_GET['action'] == "unsubscribe" ) {

		$user->remove_role("email_subscriber");
		$html = <<<EOT
			<p style='text-align:center'>
				Your email <strong>${email}</strong> has been unsubscribed. <br />
				<small>If that wasn't your intention the click here to <a href='${home_url}/wp-signup.php?id=${user_id}&email=${email}&token=${user_token}&action=subscribe'>resubscribe</a></small>
			</p>
EOT;
		wp_die( $html, "Unsubscribe from email newsletters" );

	}

	// If action not matched then proceed to default wp-signup.php page.

}

/**
 * Manage subscription signup to email newsletters
 */
function wp_freighter_subscription_signup() {

	global $pagenow;

	// Hook into wp-signup.php page if arguments found
	if ( 'wp-signup.php' !== $pagenow || !isset( $_GET['entry_email'] ) || !isset( $_GET['entry_id'] ) || !isset( $_GET['action'] ) ) {
		return;
	}

	// Find Gravity Form submission
	$entry   = GFAPI::get_entry( $_GET['entry_id'] );
	$form_id = $entry['form_id'];

	// Verifies Form ID #1
	if ( $form_id != "1" ) {
		wp_die( "<p style='text-align:center'>Invalid email subscription signup link.</p>", "Manage subscription to email newsletters" );
	}

	// Verifies email exists and matches Gravity Form entry
	if ( !$entry || !isset( $entry[2] ) || $entry[2] != $_GET['entry_email'] ) {
		wp_die( "<p style='text-align:center'>Invalid email subscription signup link.</p>", "Manage subscription to email newsletters" );
	}

	$email         = $_GET['entry_email'];
	$email_compare = "email-subscriber_$email";
	$home_url      = get_home_url();

	// Find user matching ID and email address.
	$user = get_user_by( "email", $email_compare );

	// Generate user account if needed
	if ( !$user ) {
		$user = new WP_User;
		$user->role       = "email_subscriber";
		$user->user_login = $email_compare;
		$user->user_email = $email_compare;
		$user->first_name = $entry["1.3"];
		$user->last_name  = $entry["1.6"];
		$user_id          = wp_insert_user( $user );
		$user             = get_user_by( "ID", $user_id );
	}

	$user_token = wp_hash( $user->user_registered );
	$user_id    = $user->ID;

	if ( $_GET['action'] == "subscribe_confirm" ) {

		$user->add_role("email_subscriber");
		$html = <<<EOT
			<p style='text-align:center'>
				Your email <strong>$email</strong> has been subscribed. <br />
				<small>If that wasn't your intention the click here to <a href='${home_url}/wp-signup.php?id=${user_id}&email=${email}&token=${user_token}&action=unsubscribe'>unsubscribe</a></small>
			</p>
EOT;
		wp_die( $html, "Subscribe to email newsletters" );

	}

}

/**
 * Generate email subscriber account with "email-subscriber_" placeholders.
 */
function wp_freighter_generate_email_subscriber( $entry, $form ) {

	$email_compare    = "email-subscriber_" . rgar( $entry, '2' );
	$user             = new WP_User;
	$user->role       = "email_subscriber";
	$user->user_login = $email_compare;
    $user->user_email = $email_compare;
    $user->first_name = $entry["1.3"];
    $user->last_name  = $entry["1.6"];
	$user_id          = wp_insert_user( $user );
	
}

/**
 * Creates new shortcode [email_user_token] which is useful for generating secured unsubscribe links.
 */
function wp_freighter_bnfw_recipient_token_shortcode( $message, $user_id, $prefix ) {

	$user    = get_user_by( "ID", $user_id );
	$message = str_replace( '[' . $prefix . 'user_token]', wp_hash( $user->user_registered ), $message );
    return $message;

}

/**
 * Cleanup outgoing emails which contain "email-subscriber_" placeholders.
 */
function wp_freighter_bnfw_replace_mail( $args ) {

    if ( ! isset( $args[ "to" ] ) && strpos( $args[ "to" ], "email-subscriber_" ) !== true ) {
        return $args;
    }
    $args[ "to" ]      = str_replace( "email-subscriber_", "", $args[ "to" ] );
    $args[ "message" ] = str_replace( "email-subscriber_", "", $args[ "message" ] );
    return $args;

}