Let a passwordless subscriber set their first password
Recognise an account whose password Benecaster generated, with \Benecaster\Support\GeneratedPasswordMarker.
⚠⚠ WordPress records nothing that tells these accounts apart, and it cannot be inferred from the hash — every one of them has a real hash of a real 24–32 character string. The marker is written at the moment the password is generated, which is the only moment the fact is known.
Four core flows create them: [benecaster_follower_signup]‘s email-first signup, admin bulk enrolment, manual subscriber add, and the donation-completion webhook. If your add-on provisions subscriber accounts the same way, mark them too — otherwise your users get asked for a current password they have never had.
⚠ Absence of the marker is not proof the user chose their password. Accounts provisioned before it shipped carry none and there is nothing to back-fill from. Treat “no marker” as “assume they have one”, which is the stricter answer; the account page’s Set a password link is their route.
Core clears it on wp_set_password, on a profile_update that changed user_pass, and on its own POST /account/profile write. You do not need to clear it yourself.
Code
<?php
// Provisioning an account nobody is present to choose a password for.
$user_id = wp_create_user( $login, wp_generate_password( 32, true, true ), $email );
if ( ! is_wp_error( $user_id ) ) {
\Benecaster\Support\GeneratedPasswordMarker::mark( (int) $user_id );
}
// Anywhere you render your own "change password" form: drop the
// "current password" field for people who have never had one.
if ( \Benecaster\Support\GeneratedPasswordMarker::is_generated( $user_id ) ) {
// ask only for the new password
}