Use a timing attack safe hash comparison method
Use a timing attack safe hash comparison method

PHP 5.6 and up have `hash_equals()` built-in, but Wordpress provides a polyfill for legacy applications as well. Using it here defends against timing attacks.

dornaweb/wp-email-verification,dornaweb/wp-email-verification