WordPress plugin installed on 1 million+ sites logged plaintext passwords

AIOS bills itself as an "all-in-one" security solution. A just-fixed bug undermined that.