That behavior hasn't changed. It can only access plaintext passwords during plaintext operations. That means directly after registration (frontend: onAfterUserRegistration, backend: onAfterNewUser), after profile edit if password changed (frontend: onAfterUserUpdate, backend: onAfterUpdateUser), and after logging in (onAfterLogin).

I've tested onAfterLogin and onAfterUserRegistration both properly giving plain text password. It grabs the plaintext password from POST so if you don't have the password field accessible to the user during registration it won't be able to grab the plaintext password.

Try using [var1_password] to access it directly. The [password] substitution is a special case and was supposed to only be substituting when it was clearly available in POST. In all other cases it should be nulled to prevent passwords from storing accidentally during user stores in various actions. Will review adding a fallback from POST to grab from user object, but in most cases those will just be encoded.

forge.joomlapolis.com/issues/6781