Index: wp-includes/compat.php
===================================================================
--- wp-includes/compat.php	(revision 35753)
+++ wp-includes/compat.php	(working copy)
@@ -228,15 +228,15 @@
 
 if ( ! function_exists( 'hash_equals' ) ) :
 /**
- * Compare two strings in constant time.
+ * Timing attack safe string comparison
  *
  * This function was added in PHP 5.6.
- * It can leak the length of a string.
+ * It can leak the length of a string when arguments of differing length are supplied.
  *
  * @since 3.9.2
  *
  * @param string $a Expected string.
- * @param string $b Actual string.
+ * @param string $b Actual, user supplied, string.
  * @return bool Whether strings are equal.
  */
 function hash_equals( $a, $b ) {