WordPress Plugin Criticized for Storing Passwords in Plaintext

All-In-One Security (AIOS), a widely-used WordPress plugin with over 1 million installations, has issued a security update to fix a bug which caused users' passwords to be stored in plaintext on the WordPress site’s database. AIOS confirmed that the bug, introduced in version 5.1.9, has been resolved in the latest release, version 5.2.0.

While a representative from AIOS clarified that exploiting this bug would require high-level administrative access to the WordPress installation, security experts have long cautioned against storing passwords in plaintext due to the risk of data breaches.

The maintainers of AIOS, UpdraftPlus, acknowledged that a malicious actor with administrative privileges could potentially access the plaintext passwords. They could then try to access the user’s accounts for various services online with these compromised passwords — if the user is using the same password and the account isn’t protected by two-factor authentication, gaining access would be simple.

The issue was reported by a user almost three weeks ago, highlighting the surprise that a security plugin would have such a fundamental flaw.

In an advisory, AIOS emphasized the importance of keeping plugins up to date and changing passwords regularly, especially in cases of suspected compromise. It also encourages the use of two-factor authentication as an effective security measure.

AIOS also clarified that the security update removes all previously logged passwords from the database and prevents future logging. However, it's important to note that exploiting this vulnerability would require an attacker to have already compromised a WordPress site through other means and obtained administrative privileges or unauthorized access to unencrypted site backups.

Users of AIOS are urged to install the security update promptly and ensure that the log deletion process functions correctly. Those who suspect their passwords may have been captured by a WordPress site using AIOS are advised to change their passwords on that site and anywhere else the same password is used.