318 reputation
29
bio website
location
age
visits member for 3 years, 8 months
seen Oct 17 at 20:25

Aug
19
comment Why are passwords exportable as plain text in WordPress?
@JasmineLognnes A membership plugin could potentially hook into or replace the site's registration and log-in forms and store initial and updated passwords as plain text somewhere. It sounds like that's what might be happening here. It could be a bug. There's an unresolved ticket here from a month ago where a user posts the same issue you describe.
Aug
19
comment Why are passwords exportable as plain text in WordPress?
@JasmineLognnes It sounds like that plugin's worth investigating further. It's very hard to export plaintext passwords from the hashed ones stored in the database, but I suppose it's possible that a malicious or poorly thought-out plugin is saving passwords in plain text as they're typed when users log in? It would be worth using PhpMyAdmin to search the database for one of the plaintext passwords too – it might point to the plugin that's added those rows to the database. If you do find the culprit, don't forget to answer your own question – it would be interesting to know more.
Aug
18
awarded  Commentator
Aug
18
comment Why are passwords exportable as plain text in WordPress?
@JasmineLognnes A couple of ways you could investigate: (A) Download the whole /wp-content/plugins/ folder to your machine, then search the plugins folder for the word, “Export” using the command line or a text editor that supports multi-file search. (B) Recreate the entire site on your local machine, then turn off plugins until the Export feature disappears.
Aug
18
comment Why are passwords exportable as plain text in WordPress?
I only see a "Delete" option under "Bulk Actions" in the Users page (WP 3.9.2) with all users selected: d.pr/i/M2YO Are you using a plugin to get the user export functionality?
Jan
21
awarded  Constituent
Jan
13
awarded  Caucus
Oct
18
awarded  Scholar
Oct
18
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
Many thanks – that gives me enough to work with!
Oct
18
accepted What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
Oct
16
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
@CharlesClarkson I reference that page in the first sentence of my question. It says not to use the above constants, but doesn't suggest an alternative to things like WP_PLUGIN_DIR, hence my question here.
Oct
16
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
(I'm specifically interested in finding the full path to installed plugins other than the plugin that contains my own code, in case that helps to explain.)
Oct
16
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
Thanks for this, but your answer seems to deal with URLs rather than absolute server paths, which is what I was interested in. For example, plugins_url() returns the URL to the plugins folder, not the full path to the directory on the server. Are there similar functions for handling directories that I'm not aware of? Or is the advice not to use the WP_PLUGIN_DIR constant simply wrong?
Oct
16
awarded  Student
Oct
16
awarded  Critic
Oct
16
asked What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
Jan
29
answered Wordpress plugin archive
Dec
16
awarded  Yearling
Jun
7
revised Detecting a WordPress URL without doing a full HTTP GET?
Added info regarding Link header on wp.com blogs
Jun
7
comment Detecting a WordPress URL without doing a full HTTP GET?
@Rarst Yes - that's the caveat. It's possible for sites to spoof this, and there may be some that use the page_id variable already. Any sort of detection method using headers can probably be spoofed, so I don't think it's worth worrying too much about that. Which just leaves false positives for custom CMS. I couldn't think of a more WordPress-specific variable that would be less likely to be used elsewhere. Is there one?