A plaintext password is a password stored in readable form, instead of being protected by a one-way hash or by encryption. If an attacker reaches the database, backup, log file, or export that contains it, the secret can be used immediately without cracking.
This matters because plaintext storage turns a data breach into direct account compromise. In real incidents, passwords may appear in custom fields, application logs, admin exports, support tools, or poorly designed plugins and scripts. Defenders should never store passwords in plaintext, should use modern salted hashing for authentication secrets, and should rotate any credentials that may have been exposed. The presence of plaintext passwords usually signals a deeper design or configuration failure.