Possible Timing Side-Channel in XMLRPC Verification

How it was found

https://github.com/Automattic/jetpack/blob/bc7a4541ef6f0e9f583376d801ab0c40cfb976c3/class.jetpack-xmlrpc-server.php#L115

I mentioned this to @daljo628 and he suggested submitting it here instead.

This looks very much like a classic timing attack vulnerability. The fix would be to use hash_equals() (which I have provided a sane polyfill for in sarciszewski/php-future if you don't already have one handy).