- This topic has 4 replies, 3 voices, and was last updated 7 years, 3 months ago by
.
-
Posts
-
Hi,
I’ve recently joined a existing wp installation as admin and have discovered, that the passwords of the users stored in the simple memberships user table are stored in cleartext.
On a fresh setup local test installation with the plugin enabled I could not reproduce this.
Is there somewhere a hidden switch, to enable hashing of the passwords?
Is there somewhere a hidden switch, to enable hashing of the passwords?
There is no “switch.” Hashing takes place (practically) immediately; meaning there should be no unhashed password variables hanging around in memory.
On a fresh setup local test installation with the plugin enabled I could not reproduce this.
There has only been one other reported, but unreproducible, instance of what you are reporting. Since we can’t reproduce it, the presumption is that perhaps the existing WP instance has a possible (but unprovable) malware issue.
SWPM is “Open Source” code. We invite anyone to perform a security audit (at their expense) of the plugin.
All user passwords are stored in the DB securely using the exact same method used by WordPress itself. The user passwords are hashed then stored in the DB. Unless something is messed up with your install somehow, there is no way the passwords will be stored without it being hashed.
Did you site get hacked in the past maybe?
Alternatively, you maybe referring to the email that gets sent after registration. That email can contain the password entered by the user (if you are using the {password} email merge tag).
Nope, referring to the table in the database. I’ve updated the plugin now to the newest version (previously installed was 3.4.x).
Interestingly, all users now have to reset their passwords, because the pw’s stored in cleartext aren’t supported by phpass.
After resetting the password, the new one is beeing hashed and looks like a proper wordpress/phpass entry.
Thanks for the support!
- You must be logged in to reply to this topic.