Severe performance issue in Password Protection module

Hi,

I’m experiencing random severe latency on a WordPress website using ASE.

During profiling, I found that some frontend requests can take around 123 seconds to complete.

Example:

• Total request time: 122,994 ms
• wp-includes/pluggable.php -> wp_check_password(): 120,760 ms
• Elementor: ~875 ms
• Database queries: ~150 ms
• cURL: ~230 ms

I searched the codebase for calls to wp_check_password() and found the frontend Password Protection module here:

wp-content/plugins/admin-site-enhancements/classes/class-password-protection.php

around line 162.

The code appears to retrieve the asenha_password_protection cookie and use it as the hash parameter passed to wp_check_password().

A normal bcrypt benchmark on the same server gives:

PASSWORD_BCRYPT cost 10: ~79 ms

So the server itself does not appear to have a bcrypt performance issue.

This makes me suspect that a malformed or unusually expensive bcrypt hash stored in the asenha_password_protection cookie could cause wp_check_password() to consume a very large amount of CPU time.

The issue is intermittent, which would also be consistent with the request depending on the cookie value.

Disabling ASE Password Protection and replacing it with HTTP Basic Auth / .htpasswd appears to be a suitable workaround.

Could you please review whether the cookie value should be validated before it is passed to wp_check_password()?

In particular, it may be worth checking:

• that the hash has the expected format
• that the bcrypt cost is within an acceptable range
• that malformed/unexpected cookie values are rejected before password verification

I can provide profiling screenshots and additional testing if needed.

Thanks,