This is not a bug, but it is enough for me to react. You should never ever ever ever store passwords in plain text. As users often uses the same password different places.

How I know you are storing it in plain text?
well I asked to retrieve my password and you guys sent me my password. The server should only have a salted hash of my password.