Timing Attack in Google Authenticator - Per User Prompt

*Google Authenticator - Per User Prompt* contains a timing attack vulnerability in how it validates the application password for a user account.

if ( sha1( $attempted_password_plaintext ) === $valid_password_hash || wp_check_password( $attempted_password_plaintext, $valid_password_hash ) ) {
	$this->is_using_application_password = true;
	return $user;
}