wp_login hook not firing on login for users with a two-factor option enabled

[adriantoll]

Describe the bug

The wp_login hook is not firing after a successful login for users with a two-factor option enabled when using a fresh installation with only Two Factor installed.

Steps to Reproduce

1. Install WordPress
2. Install Two Factor
3. Enable Email 2FA for the user and log out
4. Add this code to the top of the functions.php file of the twentytwentyfour theme:

function namespace_user_login( $user_login, $user ) {
  error_log('wp_login');
}
add_action( 'wp_login', 'namespace_user_login', 10, 2 );

5. Log in again
6. Check the error log - there is no wp_login message, and there are no other error messages.

Environment information

• WordPress version 6.4.2
• Twenty Twenty Four theme version 1.0
• Two Factor version 0.8.2
• PHP version 8.1

Please confirm that you have searched existing issues in this repository.

Yes

Please confirm that you have tested with all plugins deactivated except Two-Factor.

Yes

[kasparsd]

This plugin relies on wp_login for all of its functionality so it isn't possible that the WP core hook isn't firing:

two-factor/class-two-factor-core.php

Line 98 in 7e0d337

add_action( 'wp_login', array( __CLASS__, 'wp_login' ), 10, 2 );

Add this code to the top of the functions.php file

Could it be that the functions.php of the active theme is not loaded during wp-login.php processing?

[kasparsd]

I take it back, this probably happens because of the wp_login hook priority. We're adding it at 10 and then showing the two factor screen afterwards with an exit at the end:

two-factor/class-two-factor-core.php

Lines 566 to 567 in 7e0d337

	self::show_two_factor_login( $user );
	exit;

which prevents any hooks with later priority from firing. This is the same as #297.