8

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export.

When I look in the mySQL database with phpMyAdmin, the passwords are hashed.

Question

How come all user passwords can be exported in plain text, and how can I prevent this?

Update

When I either export one user or "Export All Users" I get output similar to this

User ID,Username,Payment Status,First Name,Last Name,Address,Zip,City,Country,Date,Sex,Phone no.,Email,Company,Password,TOS,Website,AIM,Yahoo IM,Jabber/Google Talk,Biographical Info,Registered,IP
"31","xxx","paid","Jasmine","Lognnes","xxx","xxx","xxx","","xxx","female","","xxx","xxx","xxx","agree","","","","","","2012-01-26 18:13:19","xxx"
Improve this question
12
  • 7
    I only see a "Delete" option under "Bulk Actions" in the Users page (WP 3.9.2) with all users selected: d.pr/i/M2YO Are you using a plugin to get the user export functionality?
    – Nick
    Aug 18, 2014 at 10:45
  • 1
    @JasmineLognnes A couple of ways you could investigate: (A) Download the whole /wp-content/plugins/ folder to your machine, then search the plugins folder for the word, “Export” using the command line or a text editor that supports multi-file search. (B) Recreate the entire site on your local machine, then turn off plugins until the Export feature disappears.
    – Nick
    Aug 18, 2014 at 16:04
  • 4
    Are you absolutely certain you are seeing plain text passwords? There has never been such an option in WordPress. It has used phpass since 2.5, and md5 hashes before that.
    – Michael Hampton
    Aug 18, 2014 at 20:52
  • 1
    @JasmineLognnes It sounds like that plugin's worth investigating further. It's very hard to export plaintext passwords from the hashed ones stored in the database, but I suppose it's possible that a malicious or poorly thought-out plugin is saving passwords in plain text as they're typed when users log in? It would be worth using PhpMyAdmin to search the database for one of the plaintext passwords too – it might point to the plugin that's added those rows to the database. If you do find the culprit, don't forget to answer your own question – it would be interesting to know more.
    – Nick
    Aug 19, 2014 at 16:15
  • 2
    If you're in the UK, and accepting payments, and have plaintext passwords saved or in a 2 way encryption format, as your question suggests, then you would not be PCI compliant, and your implementation would be illegal
    – Tom J Nowell ♦
    Aug 19, 2014 at 22:19

2 Answers 2

Reset to default
15

You cannot export passwords as plaintext in WordPress, because they are not stored in plaintext. What you see here is obviously the result of a very bad plugin.

Fields like Payment, Sex or Company are not even part of the regular WordPress tables.

For the future: Do not install plugins without prior tests and reviews in a safe environment. Use a local setup to find such security problems. Especially when you are dealing with other peoples data, this is a requirement.

What you should do now: Disable all plugins until this export is not possible anymore. The last disabled plugin was probably the problem. Find all the tables that it has created, delete those tables. Uninstall that plugin.

Improve this answer
8

It is a bug in wp-members plugin. Others have reported the same error.

Improve this answer
3
  • 5
    The bug here is a poor UI. It seems wp-members allows you add custom fields to the registration form, including "password" field. What is not (understandably) clear to users is that these added fields are just for collecting meta data, and the "password" refers to the HTML input type alone and is nothing to do with the user's WP password, nor comes with any guarantee of storing it securely.
    – Stephen Harris
    Aug 20, 2014 at 15:11
  • 2
    Toscho already have the votes ;) but I think this comment is a much better answer....
    – Mark Kaplun
    Aug 20, 2014 at 15:27
  • Actually, this is not a better answer. It's not a bug in the plugin, but rather "user error." Of the two posts linked to in this answer, the first one isn't even talking about WP-Members. It's talking about a completely different and unrelated plugin, user meta pro. And if anyone bothered to read the second post linked to, you'd see the answer to this is due to the way the user configured their custom fields and not something inherent in the plugin. The plugin does not store passwords as plain text, nor as user meta.
    – butlerblog
    Mar 4, 2015 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.