wp-includes/user.php:242Authenticates a user using the email and password.
$userWP_User|WP_Error|null$emailstring$passwordstringWP_User|WP_ErrorOne hook fires while wp_authenticate_email_password() runs, in this order:
Filters whether the given user can be authenticated with the provided password.
function wp_authenticate_email_password( $user, $email, #[\SensitiveParameter] $password) { if ( $user instanceof WP_User ) { return $user; } if ( empty( $email ) || empty( $password ) ) { if ( is_wp_error( $user ) ) { return $user; } $error = new WP_Error(); if ( empty( $email ) ) { // Uses 'empty_username' for back-compat with wp_signon(). $error->add( 'empty_username', __( '<strong>Error:</strong> The email field is empty.' ) ); } if ( empty( $password ) ) { $error->add( 'empty_password', __( '<strong>Error:</strong> The password field is empty.' ) ); } return $error; } if ( ! is_email( $email ) ) { return $user; } $user = get_user_by( 'email', $email ); if ( ! $user ) { return new WP_Error( 'invalid_email', __( 'Unknown email address. Check again or try your username.' ) ); } /** This filter is documented in wp-includes/user.php */ $user = apply_filters( 'wp_authenticate_user', $user, $password ); if ( is_wp_error( $user ) ) { return $user; } $valid = wp_check_password( $password, $user->user_pass, $user->ID ); if ( ! $valid ) { return new WP_Error( 'incorrect_password', sprintf( /* translators: %s: Email address. */ __( '<strong>Error:</strong> The password you entered for the email address %s is incorrect.' ), '<strong>' . esc_html( $email ) . '</strong>' ) . ' <a href="' . wp_lostpassword_url() . '">' . __( 'Lost your password?' ) . '</a>' ); } if ( wp_password_needs_rehash( $user->user_pass, $user->ID ) ) { wp_set_password( $password, $user->ID ); } return $user;}Introduced in 4.5.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.