Users: Do not send an email change notification when there was no previous address

src/wp-includes/user.php

@@ -2782,7 +2782,15 @@ function wp_update_user( $userdata ) {
 		$send_password_change_email = apply_filters( 'send_password_change_email', true, $user, $userdata );
 	}
 
-	if ( isset( $userdata['user_email'] ) && $user['user_email'] !== $userdata['user_email'] ) {
+	/*
+	 * Only notify of an email change when there is a previous address to notify.
+	 * The change notification is sent to the old address, so when a user had no
+	 * email set (for example an account created during an import), there is no
+	 * recipient and the notification would be sent to an empty address.
+	 */
+	if ( isset( $userdata['user_email'] ) && '' !== $user['user_email']
+		&& $user['user_email'] !== $userdata['user_email']
+	) {
 		/**
 		 * Filters whether to send the email change email.
 		 *

tests/phpunit/tests/user.php

@@ -1708,6 +1708,48 @@ public function test_email_change() {
 		$this->assertSame( $user->user_email, 'test2@example.com' );
 	}
 
+	/**
+	 * Ensures no email change notification is triggered when the account had no previous address.
+	 *
+	 * The notification is addressed to the old email, so an account that never had
+	 * an address (for example one created during a content import) has no recipient,
+	 * and the notification would otherwise be sent to an empty address.
+	 *
+	 * @ticket 47618
+	 *
+	 * @covers ::wp_update_user
+	 */
+	public function test_email_change_email_not_triggered_when_old_email_is_empty() {
+		global $wpdb;
+
+		$user_id = self::factory()->user->create();
+
+		// Blank the address to reproduce an account imported without an email.
+		$wpdb->update( $wpdb->users, array( 'user_email' => '' ), array( 'ID' => $user_id ) );
+		clean_user_cache( $user_id );
+
+		$this->assertSame( '', get_userdata( $user_id )->user_email, 'The account should start with no email address.' );
+
+		$change_email_triggered = false;
+		add_filter(
+			'send_email_change_email',
+			static function ( $send ) use ( &$change_email_triggered ) {
+				$change_email_triggered = true;
+				return $send;
+			}
+		);
+
+		$update = wp_update_user(
+			array(
+				'ID'         => $user_id,
+				'user_email' => 'new@example.com',
+			)
+		);
+
+		$this->assertSame( $user_id, $update, 'The email address should have been updated.' );
+		$this->assertFalse( $change_email_triggered, 'The email change notification should not be triggered when there is no previous address.' );
+	}
+
 	/**
 	 * Testing wp_new_user_notification email statuses.
 	 *