bcraw

Thanks, we see it on the wp_admin in this field only detective_mode_post_raw (The others it has ***) we also have some.

this is not a Ultimate Member log in:

Same transaction (data redacted)
EG: The RAW post field shows the password without *** contains this string:

detective_mode_post_raw : log=<USERNAME>&wfls-email-verification=&pwd=<PLAINPASSWORD>turnstile-response=0.yxYqydE7JFfi1N9Ihot…….

detective_mode_post: “log”: “<USERNAME>”, “wfls-email-verification”: “”, “pwd”: “***“, “cf-turnstile-response”: “0.yxYqydE7JFfi1N9Ihot…….