CVE-2026-88785

Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.

Affected

Simple Membership

CVSS v3.1 CNA

4.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.09% chance of exploitation in the next 30 days, 0th percentile

Published

2026-10-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7d9a6fe5-fcfc-48f0-a811-8623a69422df/

References

• CVE Record
• NVD entry