要完成用户激活过程，您需要执行以下步骤：

创建新用户后，添加一个表示该用户必须激活其帐户的自定义用户字段发送一封带有激活码的电子邮件，在该电子邮件中提供一个链接，指向当用户尝试登录时用户将被激活的页面，检查该自定义用户字段是否存在。如果存在，则不要让他登录并显示激活错误消息

Add custom field and send email:

function _new_user($data) {

    // Separate Data
    $default_newuser = array(
        \'user_pass\' =>  wp_hash_password( $data[\'user_pass\']),
        \'user_login\' => $data[\'user_login\'],
        \'user_email\' => $data[\'user_email\'],
        \'first_name\' => $data[\'first_name\'],
        \'last_name\' => $data[\'last_name\'],
        \'role\' => \'pending\'
    );

    $user_id = wp_insert_user($default_newuser);
    if ( $user_id && !is_wp_error( $user_id ) ) {
        $code = sha1( $user_id . time() );
        $activation_link = add_query_arg( array( \'key\' => $code, \'user\' => $user_id ), get_permalink( /* YOUR ACTIVATION PAGE ID HERE */ ));
        add_user_meta( $user_id, \'has_to_be_activated\', $code, true );
        wp_mail( $data[\'user_email\'], \'ACTIVATION SUBJECT\', \'CONGRATS BLA BLA BLA. HERE IS YOUR ACTIVATION LINK: \' . $activation_link );
    }
}

Check user activation on login:

// override core function
if ( !function_exists(\'wp_authenticate\') ) :
function wp_authenticate($username, $password) {
    $username = sanitize_user($username);
    $password = trim($password);

    $user = apply_filters(\'authenticate\', null, $username, $password);

    if ( $user == null ) {
        // TODO what should the error message be? (Or would these even happen?)
        // Only needed if all authentication handlers fail to return anything.
        $user = new WP_Error(\'authentication_failed\', __(\'<strong>ERROR</strong>: Invalid username or incorrect password.\'));
    } elseif ( get_user_meta( $user->ID, \'has_to_be_activated\', true ) != false ) {
        $user = new WP_Error(\'activation_failed\', __(\'<strong>ERROR</strong>: User is not activated.\'));
    }

    $ignore_codes = array(\'empty_username\', \'empty_password\');

    if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) {
        do_action(\'wp_login_failed\', $username);
    }

    return $user;
}
endif;

Activation page:

add_action( \'template_redirect\', \'wpse8170_activate_user\' );
function wpse8170_activate_user() {
    if ( is_page() && get_the_ID() == /* YOUR ACTIVATION PAGE ID HERE */ ) {
        $user_id = filter_input( INPUT_GET, \'user\', FILTER_VALIDATE_INT, array( \'options\' => array( \'min_range\' => 1 ) ) );
        if ( $user_id ) {
            // get user meta activation hash field
            $code = get_user_meta( $user_id, \'has_to_be_activated\', true );
            if ( $code == filter_input( INPUT_GET, \'key\' ) ) {
                delete_user_meta( $user_id, \'has_to_be_activated\' );
            }
        }
    }
}