wp-includes/class-phpass.php:247$password$stored_hash function CheckPassword($password, $stored_hash) { if ( strlen( $password ) > 4096 ) { return false; } $hash = $this->crypt_private($password, $stored_hash); if ($hash[0] === '*') { $hash = crypt($password, $stored_hash); } # This is not constant-time. In order to keep the code simple, # for timing safety we currently rely on the salts being # unpredictable, which they are at least in the non-fallback # cases (that is, when we use /dev/urandom and bcrypt). return $hash === $stored_hash; }Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/class-phpass.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.