WordPress DB_PASSWORD usually sits plaintext together with DB_HOST and DB_USER in wp-config.php in the root directory of your WP.

Usually, it's not a problem, the .php files are executed so nobody should be able to read them.

But what if a plugin backs them up and stores it in a .zip? And this .zip is somewhere accessible?

I know there's still quite a lot of time, but it's a fast approaching and this is a generic question.

Are you generally "hunting" to buy a yearly license around that time with a promo?
If you found a plugin you want to buy today - would you wait for a BlackFriday promo?

https://preview.redd.it/vw3yjapvnmrh1.png?width=875&format=png&auto=webp&s=e4c15adf143ac0db9fac465015080fff5fabf5d4

Another day, another vulnerability.

https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability

I'm managing tens of WordPress websites, own and client, live and staging. Of course wherever I can I have all the auto updates enabled.

Still, WordPresses can be quite noisy with their email notifications:

"Some plugins have failed to update"
"WordPress was updated"
etc.

I got tired of that so I made a small plugin that just silences most of them ( only keeps the Recovery Mode emails ) - of course controllable with filters, and published to the repo.

I assume that most of the people in similar situation already have a solution for that. But if someone doesn't - there you go.