WordPress Core Authentication + Password Expiration Plugin: Least‑Privilege Interaction on Expired Credentials

WordPress core auth + password expiration: least‑privilege sequencing

WordPress core does not execute capability checks after a plugin‑initiated authentication failure caused by expired credentials. Once the authentication cookie is invalidated, current_user is cleared and current_user_can() returns false without core running any capability evaluation. This behavior is consistent across supported WordPress versions, because the auth cookie check short‑circuits before the main query or template rendering begins.

Confirmed facts

• Core’s wp_validate_auth_cookie() returns a WP_Error or false when the password has expired, which plugins typically check to trigger logout or redirect.

Likely variations

• The redirect to wp-login.php is not guaranteed by core before content loads; it depends on whether the plugin calls wp_redirect() with exit() or uses template hooks that terminate early.
• Some expiration plugins may defer the redirect or fail to unset the cookie, causing core to render content with the prior user context until the redirect takes effect.
• Omitting exit() after wp_redirect( wp_login_url() ) can allow subsequent PHP to execute with the stale authenticated user.

To verify your particular installation, take these steps:

1. Enable WP_DEBUG and run var_dump( $current_user ) after triggering expiration; confirm whether capability checks short‑circuit before any HTML output.
2. Insert a temporary filter on auth_cookie_valid that logs hook priority and return value; this reveals whether core or your plugin controls the least‑privilege transition.
3. Check if the expiration plugin calls wp_clear_auth_cookie() or wp_invalidate_auth_cookie() within the auth_cookie_valid hook. If it does, capability checks will not execute after the auth failure.

If your plugin uses wp_clear_auth_cookie() within auth_cookie_valid, capability checks will short‑circuit before any content renders. Does your plugin invoke this hook, or does it rely on a template‑level redirect without clearing the cookie? Confirming this will clarify whether capability checks may briefly execute.