WordPress DB_PASSWORD usually sits plaintext together with DB_HOST and DB_USER in wp-config.php in the root directory of your WP.

Usually, it's not a problem, the .php files are executed so nobody should be able to read them.

But what if a plugin backs them up and stores it in a .zip? And this .zip is somewhere accessible?