wp-includes/pluggable.php:2648Checks a plaintext password against a hashed password.
$passwordstring$hashstring$user_idstring|intoptional''bool2 hooks fire while wp_check_password() runs, in this order:
Filters whether the plaintext password matches the encrypted password.
Filters whether the plaintext password matches the encrypted password.
function wp_check_password( $password, $hash, $user_id = '' ) { global $wp_hasher; // If the hash is still md5... if ( strlen( $hash ) <= 32 ) { $check = hash_equals( $hash, md5( $password ) ); if ( $check && $user_id ) { // Rehash using new hash. wp_set_password( $password, $user_id ); $hash = wp_hash_password( $password ); } /** * Filters whether the plaintext password matches the encrypted password. * * @since 2.5.0 * * @param bool $check Whether the passwords match. * @param string $password The plaintext password. * @param string $hash The hashed password. * @param string|int $user_id User ID. Can be empty. */ return apply_filters( 'check_password', $check, $password, $hash, $user_id ); } /* * If the stored hash is longer than an MD5, * presume the new style phpass portable hash. */ if ( empty( $wp_hasher ) ) { require_once ABSPATH . WPINC . '/class-phpass.php'; // By default, use the portable hash from phpass. $wp_hasher = new PasswordHash( 8, true ); } $check = $wp_hasher->CheckPassword( $password, $hash ); /** This filter is documented in wp-includes/pluggable.php */ return apply_filters( 'check_password', $check, $password, $hash, $user_id ); }Introduced in 2.5.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/pluggable.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.