function can_process() {

	$Auth_Result = hook_authenticate($_SESSION['wa_current_user']->username, $_POST['cur_password']);

	if (!isset($Auth_Result))	// if not used external login: standard method
		$Auth_Result = get_user_auth($_SESSION['wa_current_user']->username, md5($_POST['cur_password']));

	if (!$Auth_Result) {
		display_error( _('Invalid password entered.'));
		set_focus('cur_password');
		return false;
	}
	if (strlen($_POST['password']) < 4) {
		display_error( _('The password entered must be at least 4 characters long.'));
		set_focus('password');
		return false;
	}
	if (strstr($_POST['password'], $_SESSION['wa_current_user']->username) != false) {
		display_error( _('The password cannot contain the user login.'));
		set_focus('password');
		return false;
	}
	if ($_POST['password'] != $_POST['passwordConfirm']) {
		display_error( _('The passwords entered are not the same.'));
		set_focus('password');
		return false;
	}

	return true;
}
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.