The vulnerability stems from unencrypted password storage in CouchStatsConfig.xml. Jenkins plugins typically use a GlobalConfiguration subclass (CouchStatsConfig) with @DataBoundSetter methods for form binding. The configure() method (triggered on config save) and setPassword() method would be responsible for persisting the password value. In vulnerable versions, these functions would lack encryption logic before storing the password to disk. The fix in 0.4 likely added encryption in these methods. While exact code isn't available, this pattern matches Jenkins plugin architecture and the vulnerability description.