Ticket #42183: 42183.patch

src/wp-includes/user.php

@@ -1820 +1820 @@
         // Escape data pulled from DB.
         $user = add_magic_quotes( $user );
 
-        if ( ! empty( $userdata['user_pass'] ) && $userdata['user_pass'] !== $user_obj->user_pass ) {
-                // If password is changing, hash it now
+        if ( empty( $wp_hasher ) ) {
+                require_once( ABSPATH . WPINC . '/class-phpass.php');
+                // By default, use the portable hash from phpass.
+                $wp_hasher = new PasswordHash( 8, true );
+        }
+
+        if ( ! empty( $userdata['user_pass'] ) && false === $wp_hasher->CheckPassword( $userdata['user_pass'], $user_obj->user_pass ) ) {
+                // If password is changing, hash it now.
                 $plaintext_pass = $userdata['user_pass'];
                 $userdata['user_pass'] = wp_hash_password( $userdata['user_pass'] );