Ask for the Current Password Before Changing Email or Password
Adds a "Current password" field to the profile screen and refuses changes to your own email address or password unless it is correct, so someone using an unattended logged-in browser cannot take over the account.
Opens WPIDE on
Code
add_action( 'show_user_profile', function () {
echo '<h2>Confirm changes</h2><table class="form-table" role="presentation"><tr><th><label for="wpide-current-pass">Current password</label></th><td><input type="password" name="wpide_current_pass" id="wpide-current-pass" class="regular-text" autocomplete="current-password"><p class="description">Required to change your email address or password.</p></td></tr></table>';
} );
add_action( 'user_profile_update_errors', function ( $errors, $update, $user ) {
if ( ! $update || empty( $user->ID ) || get_current_user_id() !== (int) $user->ID ) {
return;
}
$current = get_userdata( $user->ID );
$changes = ( ! empty( $user->user_pass ) ) || ( isset( $user->user_email ) && strtolower( $user->user_email ) !== strtolower( $current->user_email ) );
if ( ! $changes ) {
return;
}
$given = isset( $_POST['wpide_current_pass'] ) ? (string) wp_unslash( $_POST['wpide_current_pass'] ) : '';
if ( '' === $given || ! wp_check_password( $given, $current->user_pass, $current->ID ) ) {
$errors->add( 'wpide_current_pass', '<strong>Error:</strong> Enter your current password to change your email address or password.' );
}
}, 10, 3 );Notes
Applies only when users edit their own profile; administrators editing other users are not asked.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.