@Edent I’d say yes, just because security on the account is somewhat compromised, but don’t leap out of bed to do it. I’m never quite comfortable trusting 2FA alone because so many companies are willing to turn it off if someone calls them up with an appropriate sounding sob story.

@Edent It's a complex and nuanced problem, but change your password.

@Edent Do you mean the email sent by the plugins team? It’s not necessarily _your_ password, but the password of _some_ plugin authors being exposed.

However: since using a password manager will also make creation of a new password an ease, better save then sorry. 🙂

@Edent
Do you have any reason not to change the password? No? Change it!

@Edent if it's the plugins email, they're not saying *your* password was (maybe?) breached, but that *some* might have been so they've decided to reset everyone's passwords.

Frankly, at this point I'm inclined to give up and declare my (unloved) plugins as end-of-life.

@Edent What's the downside to changing your password? Not seeing one. Seems like the worst case scenario is you change one randomly generated string for another, with no benefit?

@Edent I think you need to read that email closer. There was no data breach from us.

However, regarding the question, you actually do not have a choice. Your password has now been erased. You *have* to reset your password if you want back in.

https://make.wordpress.org/plugins/2024/06/29/password-reset-required-for-plugin-authors/

@Edent Something I've had to tell people in the past, because it's not clear at the user level: 2fa only protects against credential reuse across sites. If you have an app generating 2FA codes (TOTP) there's a good chance a site breach includes the shared secret, so the 2FA codes for it *also* need to be changed.

@Edent I'd say so. It's easy enough to basically cost you nothing and removes any chance of someone cracking your password, as remote as it may be.

@Edent For the effort involved, I’d just do it. https://wordpress.com/.well-known/change-password.

@namenlos
What do you mean cracking my password?
If it had been leaked, there's nothing too crack. And, crucially, I have 2FA protecting the account.

@Edent I mean, I do hope that "data breach" in that case refers to WordPress having lost the password hashes and not the clear text passwords themselves (which they shouldn't have stored anywhere). Or are we talking about you entering a password and them telling you, that they found it in some other data breach?

@Edent also, yes, 2FA still protects your account, but if someone else has your password, you're effectively down to 1FA. Hence why I would change the password anyway, 2FA or not.

@gwire a very good point!

@otto42 I think you need to write the email more clearly.

"We have begun to force reset passwords for all plugin authors and some other users whose information was found by security researchers in data breaches. "

That reads to me like "(all authors && other users) whose info was found…"

@Edent I didn't write it. However, quite simply, if you got the email, then your previous password has been invalidated. Reset it to get back in.

@Edent also, The problem there comes from the lack of a comma. It should read:

"We have begun to force reset passwords for all plugin authors, and some other users whose information was found by security researchers in data breaches."

In other words, two specific sets: all plugin authors, and some other users.

In the original the selective bolding made it more clear, however that did not come through when somebody copied and pasted to text for an email.

@otto42
The email is *really* bad. It starts as though it is a follow-up to a previous one (it isn't).
Just a bit of a confusing experience all round.

@otto42 perhaps you could pass on some feedback that it is a *very* poorly worded email.

Does anything stop me re-using my old password?

@Edent if its a good password, no. However, it will not allow use of pws found in other data breaches such as the haveibeenpwned set.

@tinguin
a) It is a faff.
b) I can't be bothered.
c) My 2FA protects the account.
d) All of the above.

@Edent
a) doesn't Matter
b) well, you should
c) only partly

@matze yes. I took it to mean I was included in the breach.

@Edent Hopefully, you’re not. 🤞🏻

@dzwiedziu ha! Fair!