CVE-2026-88785
Medium
Description
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
SeverityMedium
CVSS4.7
Exploit probability—
ProductSimple Membership
PublishedOct 11, 2026
First seenOct 11, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- Simple Membership4.8.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Simple Membership | v < 4.8.3 | 4.8.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.