blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-88785

MEDIUM 4.7 CVSS 3.1
Published
October 11, 2026
Last modified
October 13, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-200
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Simple Membership — Before 4.8.3

References

  • wpscan.com https://wpscan.com/vulnerability/7d9a6fe5-fcfc-48f0-a811-8623a69422df/
  • nvd.nist.gov Official NVD record