[dshelby]

HI,

I have the same concern.

Particularly since WP uses the ‘username’ as a unique id and a login. Meaning its not only shown in profiles and BP member information, its also used in Url paths like member and author links. Not to mention individual plugins and themes might directly reference and use ‘username’ in ways you might not anticipate. Which would mean lots of audits of all the themes, plugins and updates you use on the site. and a huge testing effort.

It seems to me that trying to shut down all those threats is time consuming, exhausting and prone for mistakes.

Why not just use ‘username’ as a unique id and turn off the ability to login by ‘username’. That way if ‘username’ is plastered all over the place, it does not matter so much — as it can not be used to login and access data.

I certainly hope WP is working on a solution to fix this issue, which I see as a security issue. (As in, you need two pieces of data to log in. Username and password. publicly providing 1 of those pieces of data (the username) severely increases security risk, problems, and issues.)

In the mean time,
I used hook action wp_authenticate to do my own login (that does not use the unique id ‘username’ ).
For more information on that hook action see https://developer.wordpress.org/reference/hooks/wp_authenticate/

Depending on where you put the ‘wp_authenticate’ solution this change can survive updates with out reapplication.

To be even more complete you can turn it off in the wordpress code, which would mean your changes would have to be reapplied after updates.