The vulnerability stems from unencrypted password storage in Jenkins' global config.xml. Jenkins plugins typically serialize configuration data through getter methods in their configuration classes. The presence of a plaintext password in config.xml indicates the password field was not properly encrypted before serialization. The getPassword() method in the plugin's configuration class would be directly responsible for exposing the plaintext value to the serialization process. This pattern matches Jenkins plugin development conventions where sensitive fields require explicit encryption handling using Secret class mechanisms, which appears absent here.