romerican

ColinABQ – Thanks for confirming the same behavior.

Surely, this must be a bug. WP cannot intend to change passwords such that users cannot login and lockout blog admins. I’ve been forced to reset passwords in MySQL with disappointing frequency. Fortunately, I know how… but I also know that is not desirable behavior.

Anyone know the story behind the symptoms?

I have continued to operate my blog, per normal, both with and without the DingShow plugin. The result is the same: I get logged out and the password value in the database changes from an MD5 hash to something like the example I gave. And the password is changed for a few other active users (registered readers) of the blog as well.

So far I’m unable to isolate any particular action or series of actions which directly cause the change. But it keep happening.

whooami, when you say it’s normal, are you sure? It certainly does *not* look normal to me, at all. It’s not an md5 hash either. Also, 90% percent of the (users who do not frequently login) accounts’ password value in mysql do not look anything like that but instead look like the md5 hashes I would expect to normally find.

Shane, thanks for your interest. I’m stuck in a place where odd behavior continues but I cannot pin down a cause. As a non-developer, I remain paranoid about hacking or injection or I don’t know what, precisely.