In reply to Dan Knauss.

An Administrator can do almost anything, so saying that access to unencrypted account credentials is not a normal Administrator privilege isn’t really true. If that was true, then then it wouldn’t be possible for this plugin to have been able to log them either.

That isn’t to say that those should be logged, but security providers shouldn’t be acting as though Administrators don’t already have access beyond what an issue in plugin can provide them.