"Confirm this subscription" URL generated by MailingEventSubscribe API should always be a front-end URL
Following on from discussion on this WordPress issue, it seems that the code in CiviCRM Core which generates the URL for use in the subscription confirmation email triggered via the MailingEventSubscribe API does not always force the URL to be a front-end URL.
This can be reproduced by using the CiviCRM API Explorer in WordPress but also applies (as is the case for the reporter) when a form is submitted via the standard WordPress AJAX route of admin_url('admin-ajax.php').
PR to follow.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information