[Pikamander2]

WordPress still uses MD5 for database passwords to this very day with no immediate plans to change it.

That said, they apparently use eight passes of MD5 hashing along with salting, which they claim is a sufficiently secure combo.

WordPress's core and default themes are known to be fairly secure, so I'd like to believe they know what they're talking about, but if nothing else it feels icky.

[Snow_Falls]

I'm confused, if they're going through the effort to make something known bad (MD5 secure, then why not just use something secure in the first place (e.g. SHA3)?