What I am more curious about is their statement that the hacker may be able to log into wpml.org accounts because their database was compromised. Does this mean they are storing account passwords in plain text? No salt? No encryption?