WordPress: Reset password always invalid key

Question

I've got a huge problem and can't find the solution. I've installed the Ultimate Member Plugin and activated it. ^

When I reset now the password for a user I'm getting an email from my page with a reset link generated in the class-password.php file of the plugin triggered by the UM function call um_user( 'password_reset_link' ) which triggers this function :

/**
 * Get Reset URL
 *
 * @return bool|string
 */
function reset_url() {
    $user_id = um_user( 'ID' );
    delete_option( "um_cache_userdata_{$user_id}" );
    //new reset password key via WP native field
    $user_data = get_userdata( $user_id );
    $key = get_password_reset_key( $user_data );
    $url =  add_query_arg( array( 'act' => 'reset_password', 'hash' => $key, 'user_id' => $user_id ), um_get_core_page( 'password-reset' ) );
    return $url;
}

To check the hash I've added an error_log in the function get_password_reset_key located in the users.php file from WordPress to log the generated hashes by the key:

error_log( $hashed );

I've also added the same hasher into the email template from Ultimate Member and this was the result:

[23-Dec-2018 15:57:41 UTC] 1545580661:$P$BiLzjLuPDHwVtUlnLmEQE19D4UpgJf0
[23-Dec-2018 15:57:41 UTC] 1545580661:$P$BCAl/MTbiuCyqiix7310EOEn.eJlQz1
[23-Dec-2018 15:57:41 UTC] 1545580661:$P$BH0W.btK4hYFNDidKh.DA46KZhp5Ay.
[23-Dec-2018 15:57:41 UTC] Hash from mail: 1545580661:$P$BOzHQ9mIasqhbdYnkK0n.EXhGXBFyD0
[23-Dec-2018 15:57:41 UTC] 1545580661:$P$BGRg8guQBbhuNKdMCIDSweNUDKLG1v/

So as you can see there are 4 hashes generated by WordPress and the one generated from the returned key directly in the email.

When I save now the generated hash in the email into the users table value for the field user_activation_key and press the reset button, I'm able to change the password.

So why is the hash generated not correctly and how can I fix this? I mean I can change the function and generate a new hash and write it again into the database but this can't be the solution.

user_290699 · Answer

What fixed my issue with UM Password Reset stating "Invalid Key" was disabling any caching on my /password-reset page. Not sure if this would fix your issue, but in case any one else comes here.

user_4743438 · Answer

If anyone staill has this problem with or without the plugin, check the reset link in email. In my example link was

the url was generated with the character > at the end and in a browser it looked like this

https://mywebsite.com/wp-login.php?action=rp&key=XXsomehashXX&login=username%3E

All it took to fix this was delete the %3E at the end of url and password reset form was functioning!

WordPress: Reset password always invalid key

2 Answers