The Simple History plugin for WordPress has a flaw where enabled Detective Mode causes the logger to write the entire contents of $_POST, and sometimes raw request bodies or $_GET, to audit logs without removing password-related keys. This means that whenever a user submits a login form—whether through the native wp_login routine or a third‑party authentication widget—their actual password is recorded in plain text. An authenticated user with sufficient privileges, such as an administrator or anyone with database read rights, can then read those logs and retrieve all captured passwords. The weakness stems from improper input sanitization (CWE‑256), leading to data leakage rather than code execution or denial of service.

WordPress installations that use the eskapism:Simple History plugin in any version up to and including 5.8.1 are vulnerable. Site administrators should verify the current plugin version; any release before 5.8.1 is affected and requires remediation.

With a CVSS score of 4.9 and an EPSS value of less than 1%, the likelihood of exploitation is low but not negligible. The vulnerability is listed as not being in the CISA KEV catalog, suggesting no widespread exploitation has been reported to date. An attacker needs only to be authenticated with sufficient privileges to access the audit logs; the attack vector is local data access rather than remote exploitation. The potential impact is the exposure of users’ plaintext passwords, which could enable credential stuffing or account compromise elsewhere.