Hash the login nonce for storage to avoid leaking it via DB access

class-two-factor-core.php

@@ -728,6 +728,17 @@ public static function login_url( $params = array(), $scheme = 'login' ) {
 		return add_query_arg( $params, site_url( 'wp-login.php', $scheme ) );
 	}
 
+	/**
+	 * Get the hash of a nonce for storage and comparison.
+	 *
+	 * @param string $nonce Nonce value to be hashed.
+	 *
+	 * @return string
+	 */
+	protected static function hash_login_nonce( $nonce ) {
+		return wp_hash( $nonce, 'nonce' );
+	}
+
 	/**
 	 * Create the login nonce.
 	 *
@@ -737,15 +748,21 @@ public static function login_url( $params = array(), $scheme = 'login' ) {
 	 * @return array
 	 */
 	public static function create_login_nonce( $user_id ) {
-		$login_nonce = array();
+		$login_nonce = array(
+			'expiration' => time() + HOUR_IN_SECONDS,
+		);
+
 		try {
 			$login_nonce['key'] = bin2hex( random_bytes( 32 ) );
 		} catch ( Exception $ex ) {
 			$login_nonce['key'] = wp_hash( $user_id . wp_rand() . microtime(), 'nonce' );
 		}
-		$login_nonce['expiration'] = time() + HOUR_IN_SECONDS;
 
-		if ( ! update_user_meta( $user_id, self::USER_META_NONCE_KEY, $login_nonce ) ) {
+		// Store the nonce hashed to avoid leaking it via database access.
+		$login_nonce_stored = $login_nonce;
+		$login_nonce_stored['key'] = self::hash_login_nonce( $login_nonce['key'] );
+
+		if ( ! update_user_meta( $user_id, self::USER_META_NONCE_KEY, $login_nonce_stored ) ) {
 			return false;
 		}
 
@@ -779,12 +796,13 @@ public static function verify_login_nonce( $user_id, $nonce ) {
 			return false;
 		}
 
-		if ( $nonce !== $login_nonce['key'] || time() > $login_nonce['expiration'] ) {
-			self::delete_login_nonce( $user_id );
-			return false;
+		if ( hash_equals( self::hash_login_nonce( $nonce ), $login_nonce['key'] ) && time() < $login_nonce['expiration'] ) {
+			return true;
 		}
 
-		return true;
+		self::delete_login_nonce( $user_id );
+
+		return false;
 	}
 
 	/**