"Popular WordPress Security Plugin Caught Logging Plaintext Passwords"

The All-In-One Security (AIOS) WordPress plugin was recently found to be logging plaintext passwords from login attempts.  Installed on over one million WordPress sites, the security and firewall plugin was designed to prevent cyberattacks such as brute-force attempts, warn when the default admin username is used for login, prevent bot attacks, log user activity, and eliminate comment spam.  It was discovered that AIOS version 5.1.9 writes plaintext passwords from login attempts to the database, which essentially provides any privileged user with access to the login credentials of all other administrator users.  The problem was identified roughly two weeks ago when users complained about the insecure design flaw on the plugin’s support forums.  Earlier this week, the Updraft team maintaining the plugin released AIOS version 5.2.0 to address the issue and remove the logged passwords from the database.  However, plugin users have been complaining about the update breaking sites and not removing the password logs.  AIOS version 5.2.1 was released on Wednesday to address these issues, but some users claim sites are still broken.  Security experts urge AIOS users to update their installations as soon as possible.  Based on WordPress statistics, hundreds of thousands of websites are still running a vulnerable version of the plugin.

SecurityWeek reports: "Popular WordPress Security Plugin Caught Logging Plaintext Passwords"