• I found an issue with this plugin with passwords containing single or double quotes or backslashes.

    WordPress is using wp_slash() internally on passwords and External-Login does not use wp_unslash() before comparing or hashing passwords.

    Simply adding:
    $password = wp_unslash($password);
    into function exlog_validate_password() in login/validate_password.php in front of the if() conditions should do just fine.

    Otherwise great plugin!

  • The topic ‘External-Login needs to apply wp_unslash() on password before validation’ is closed to new replies.