Not sure what happened to the formatting of my first attempt…. here goes again….

Sincere apologies to all AIOS users for this bug.
The above piece omits to note that the passwords are exposed only to someone who can read a copy of the WordPress database, which means, a WordPress admin (or on a multisite install, the admin of a site can see data for their own site (not other sites)).

“and will tell their security plugin users to clean those logs ASAP”

There’s no need to do that – if you’re running the current version of AIOS, then it wiped them upon update. The release took longer than we hoped to get out because of testing back-and-forth on the update task.

“Due to the scale, we will 100% see hackers harvest the credentials from the logs of compromised sites that run (or has run) this plugin.”

The WordPress security and journalism landscapes would be much improved if vendors of security products and journalists avoided hyperbolic inaccuracy, and stuck to accurate descriptions after verifying the actual situation before publishing. As per the above, in order to achieve this, the attacker would need admin-level access to harvest anything (i.e. the same level of access that would allow him to do anything that needs admin privileges on the site already), and the site owner would have to have not updated to the current AIOS release.

i.e. It’s an “admin-only” vulnerability. These aren’t desirable, of course, and hence we are genuinely sorry to all our users for its existence. But if you have admins on your site who are hostile attackers, you also need to fix that situation too, as you’ll still be vulnerable to many other problems after updating AIOS (e.g. your hostile admin could add or remove plugins or users, export data, etc etc; and if they’re not on multisite a regular admin can do anything and everything, so it’s not a privilege escalation at all).