tml_confirmaction_handler()

function tml_confirmaction_handler() {
    // phpcs:disable WordPress.Security.NonceVerification.Recommended -- mirrors wp-login.php's own confirmaction handling, which is secured by the confirm_key/wp_validate_user_request_key() token rather than a nonce.
    // phpcs:disable WordPress.WP.I18n.MissingArgDomain, WordPress.Security.EscapeOutput.OutputNotEscaped -- these messages intentionally reuse WP core's translated wp-login.php strings verbatim (static, no dynamic content), not TML-specific strings.
    if ( ! isset( $_GET['request_id'] ) ) {
        wp_die( __( 'Missing request ID.' ) );
    }

    if ( ! isset( $_GET['confirm_key'] ) ) {
        wp_die( __( 'Missing confirm key.' ) );
    }
    // phpcs:enable WordPress.WP.I18n.MissingArgDomain, WordPress.Security.EscapeOutput.OutputNotEscaped

    $request_id = (int) $_GET['request_id'];
    $key        = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
    $result     = wp_validate_user_request_key( $request_id, $key );

    if ( is_wp_error( $result ) ) {
        // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_die() natively supports WP_Error objects (extracts get_error_message() internally via _wp_die_process_input()); this is the standard wp_die( WP_Error ) pattern, not raw unescaped output.
        wp_die( $result );
        // phpcs:enable WordPress.Security.EscapeOutput.OutputNotEscaped
    }
    // phpcs:enable WordPress.Security.NonceVerification.Recommended

    /** This action is documented in wp-login.php */
    do_action( 'user_request_action_confirmed', $request_id );
}

View src/includes/actions.php, line 847 on GitHub