WordPress plugin installed on 1 million+ sites logged plaintext passwords

All-In-One Security, a WordPress security plugin installed on more than 1 million websites, has issued a security update after being caught three weeks ago logging plaintext passwords and storing them in a database accessible to website admins.

The passwords were logged when users of a site using the plugin, typically abbreviated as AIOS, logged in, the developer of AIOS said Thursday. The developer said the logging was the result of a bug introduced in May in version 5.1.9. Version 5.2.0 released Thursday fixes the bug and also “deletes the problematic data from the database.” The database was available to people with administrative access to the website.

A major security transgression

A representative of AIOS wrote in an email that “gaining anything from this defect requires being logged in with the highest-level administrative privileges, or equivalent. i.e. It can be exploited by a rogue admin who can already do such things because he’s an admin.”

However, security practitioners have long admonished admins to never store passwords in plaintext, given the relative ease hackers have had for decades in breaching websites and making off with data stored on them. In that context, the writing of plaintext passwords to any sort of database—no matter who has access to it—represents a major security transgression.

The only acceptable way to store passwords for more than two decades is as a cryptographic hash that’s generated using what’s often characterized as a slow algorithm, meaning it requires time and above-average computing resources to be cracked. This precaution acts as an insurance policy of sorts. If a database is breached, threat actors will require time and computing resources to convert the hashes into their corresponding plaintext, giving users time to change them. When passwords are strong—meaning at least 12 characters, randomly generated, and unique to each site—it’s generally infeasible for most threat actors to crack them when hashed with a slow algorithm.