A dice is being rolled continuously. Suppose you roll a 3 ( or any number ). What is the probability that you will get the next "3" exactly after n rolls?  


Question: CMS Uses http and so sends password in plain text
Answer: You have to use https.  This is not a responsibility of the CMS application, but a responsibility of the person deploying the system, to purchase a signed SSL certificate from a known trusted certificate authority (note you can purchase for free from say http://www.startssl.com or included in the cost of your domain registration at say http://gandi.net ) and force all traffic to be only sent via HTTPS.

Even if the CMS application say hashed your password client-side (using say javascript), sent the hashed password over the network, and then checked the hash server-side, the hashed password (say hash=bcrypt('Correct Horse Battery Staple', salt)= '$2a$14$XUgYF0o3flsoGam2GHiw8OlQv9BBR/ihAwS/k83fZk.YjJ1hA/04.')
 would still be sent over in plaintext for anyone to eavesdrop.  These eavesdroppers would still be able to do a replay attack (e.g., modify the client-side javascript to instead of hash an entered password, to just send back the captured hashed password $2a$14$XUgYF0o3flsoGam2GHiw8OlQv9BBR/ihAwS/k83fZk.YjJ1hA/04.) that they intercepted.  Also, note that this effectively turns the client-side hashed password into the effective password; so ideally you would additionally further hash the received hash server side to compare against what is stored in the database.  Or they could just intercept the session cookies sent over the network and use those to mimic activity of a currently logged in user.

Or they could just do mess with routing to do a man in the middle attack, so you send the password over to their server.  

Furthermore, if they required you to use SSL without having purchased a certificate, the users may be scared away due to the browser warnings of an untrusted certificate.  

A more complicated scheme may convince you that there is more security than there actually is, even though it would be trivial for an attacker to circumvent.  All that is required is to set it up using HTTPS.