Title: Plugin stores users password in clear text
Last modified: August 23, 2020

---

# Plugin stores users password in clear text

 *  [alexboerescu](https://wordpress.org/support/users/alexboerescu/)
 * (@alexboerescu)
 * [6 years ago](https://wordpress.org/support/topic/plugin-stores-users-password-in-clear-text/)
 * Hi guys,
 * Why did you mark [this topic](https://wordpress.org/support/topic/plugin-stores-password-as-plaintext/)
   as resolved?
 * In the latest version (2.1.5), the plugin still stores the user’s password in
   clear text in the USERMETA table as the value of the single_user_password key…
   This happens if you use the ootb UM account page to update your profile – the
   password you provide to authenticate yourself gets stored in the DB…
 * Please look into this ASAP as it’s a major security flaw.

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Thread Starter [alexboerescu](https://wordpress.org/support/users/alexboerescu/)
 * (@alexboerescu)
 * [6 years ago](https://wordpress.org/support/topic/plugin-stores-users-password-in-clear-text/#post-12780357)
 * The account page that I was mentioning has this short code: [ultimatemember_account]
   
   There’s no way to modify it from wp admin…
 *  [justdave](https://wordpress.org/support/users/justdave/)
 * (@justdave)
 * [6 years ago](https://wordpress.org/support/topic/plugin-stores-users-password-in-clear-text/#post-12793993)
 * I don’t have anything with a ‘single_user_password’ key in my usermeta table.
 *  [nexcc](https://wordpress.org/support/users/nexcc/)
 * (@nexcc)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/plugin-stores-users-password-in-clear-text/#post-13297715)
 * Yes, it has, even in the latest update (2.1.7).
 * When you export user personal data, you can see all members password in plain
   text at the column meta title called “single_user_password”.
 * These passwords are those who reset it after login, I would say about 30% of 
   the passwords are open to administrator’s eyes.
 * This issue was unresolved for many years, you can see the topic owner posted 
   3 years ago in another topic.
 * I would love to use this plugin in my another websites, but due to security reason,
   I backed off.
 * Kindly please resolve it asap. Thank you!
    -  This reply was modified 5 years, 8 months ago by [nexcc](https://wordpress.org/support/users/nexcc/).
    -  This reply was modified 5 years, 8 months ago by [nexcc](https://wordpress.org/support/users/nexcc/).

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Plugin stores users password in clear text’ is closed to new replies.

 * ![](https://ps.w.org/ultimate-member/assets/icon-256x256.png?rev=3160947)
 * [Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin](https://wordpress.org/plugins/ultimate-member/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/ultimate-member/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/ultimate-member/)
 * [Active Topics](https://wordpress.org/support/plugin/ultimate-member/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/ultimate-member/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/ultimate-member/reviews/)

## Tags

 * [password](https://wordpress.org/support/topic-tag/password/)

 * 3 replies
 * 3 participants
 * Last reply from: [nexcc](https://wordpress.org/support/users/nexcc/)
 * Last activity: [5 years, 8 months ago](https://wordpress.org/support/topic/plugin-stores-users-password-in-clear-text/#post-13297715)
 * Status: not resolved