Password failure in Wordpress Plugin

One of the great features of Wordpress is the wide variety of plugins available. They often enable a lot of interesting functionality and integrations to other services not native to Wordpress itself. Most of these plugins are developed by individuals or small teams independent of the core community - and often not with a keen interest in security, but an exclusive focus on “making stuff work”.

I’ve been using the Wordpress “Google AdSense Dashboard” for awhile, and after the recent host of password leaks, I’ve been changing and upgrading password all around. This change lead to expose what I would call a critical password exposure in the plugin and so far caused me to remove the plugin everywhere I’ve installed it.

The issue was the following:

If the password to Google AdSense fails in the plugin, your username and password is displayed in clear-text on screen - in the dashboard when logged into Wordpress. Where’s the catastrophic take away - the username and password seems to be stored in clear text (or at least stored by the plugin in a format which can be converted back to clear text), and secondly, apart from storing it somewhat carelessly the plugin even display the information on the login screen - apparently for each and every user.