I am using an OTP SMS Plugin which has the following code which runs on checkout and login/register page of woocommerce:
function smsalert_site_challenge_otp($user_login, $user_email, $errors, $phone_number=null,$otp_type,$password="",$extra_data=null,$from_both=false)
{
SmsAlertUtility::checkSession();
$_SESSION['current_url'] = SmsAlertUtility::currentPageUrl();
$_SESSION['user_email'] = $user_email;
$_SESSION['user_login'] = $user_login;
$_SESSION['user_password'] = $password;
$_SESSION['phone_number_mo']= $phone_number;
$_SESSION['extra_data'] = $extra_data;
_handle_otp_action($user_login,$user_email,$phone_number,$otp_type,$from_both);
}
The function is called as follows:
function _handle_validate_otp_choice_form($postdata)
{
SmsAlertUtility::checkSession();
if($postdata['mo_customer_validation_otp_choice'] == 'user_email_verification')
smsalert_site_challenge_otp($_SESSION['user_login'],$_SESSION['user_email'],null,$_SESSION['phone_number_mo'],"email",$_SESSION['user_password'],$_SESSION['extra_data'],true);
else
smsalert_site_challenge_otp($_SESSION['user_login'],$_SESSION['user_email'],null,$_SESSION['phone_number_mo'],"phone",$_SESSION['user_password'],$_SESSION['extra_data'],true);
Does this line $_SESSION['user_password'] = $password;
mean that passwords are collected?