The Sql Membership Provider has been configured as default membership provider and the configured Password Format is not set to Hashed.

When the Sql Membership Provider is used as default membership provider, it is strongly recommended to set the Password Format to Hashed. This means that the passwords itself will not be stored within the database but a hashed value. When validating user credentials, the specified password will be hashed as well and these hashes will be compared.

To change the Password Format, open the site within the Config Editor, unlock the site and switch the view to Advanced Mode. Then, in the right pane under Security you can select Hashed as Password Format.

When saving this change, the Config Editor will also offer the option to hash the passwords already existing within the database (if appropriate). Notice that hashing these passwords is irreversible.