FIXED

- The wp_check_password did not pass the filter wp_php_hash_password_algorithm and so older passwords defulted to bcrypt, if something like Argon was used causing a missmatch
timnashcouk · Feb 3, 2024 · 4ee8365 · 4ee8365
1 parent e98e387
commit 4ee8365
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/wp-php-password.php b/wp-php-password.php
@@ -27,7 +27,7 @@
 	 * @return bool
 	 */
 	function wp_check_password( $password, $hash, $user_id = '' ) {
-		if ( ! password_needs_rehash( $hash, PASSWORD_DEFAULT, apply_filters( 'wp_hash_password_options', array() ) ) ) {
+		if ( ! password_needs_rehash( $hash, apply_filters( 'wp_php_hash_password_algorithm', PASSWORD_DEFAULT ), apply_filters( 'wp_hash_password_options', array() ) ) ) {
 			return apply_filters(
 				'check_password',
 				password_verify( $password, $hash ),