CVE-2026-88785: Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

Q: Who is exposed to this issue?

Sites using a Simple Membership version earlier than 4.8.3 are exposed only when the optional auto-login-after-registration feature is enabled. The affected credentials are passwords chosen by newly registered members.

Q: What access would an attacker need to obtain a password?

An attacker would need access to a location that records or retains the registration URL, such as the affected user's browser history or web server, proxy, or CDN access logs. The password is exposed in the URL query string during registration.

Q: How can I determine whether credentials may already have been exposed?

Check whether auto-login after registration was enabled while running a version earlier than 4.8.3, then review browser-history exposure and web server, proxy, and CDN access logs for registration URLs containing password query-string values. Newly registered members during that period may need to change their passwords.

Published Oct 11, 2026

Updated

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.

Affected Software

1 affected component

Simple Membership Simple Membership WordPress plugin<4.8.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Simple Membership WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.8.3

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Sites using a Simple Membership version earlier than 4.8.3 are exposed only when the optional auto-login-after-registration feature is enabled. The affected credentials are passwords chosen by newly registered members.

What access would an attacker need to obtain a password?

An attacker would need access to a location that records or retains the registration URL, such as the affected user's browser history or web server, proxy, or CDN access logs. The password is exposed in the URL query string during registration.

How can I determine whether credentials may already have been exposed?

Check whether auto-login after registration was enabled while running a version earlier than 4.8.3, then review browser-history exposure and web server, proxy, and CDN access logs for registration URLs containing password query-string values. Newly registered members during that period may need to change their passwords.

CVE-2026-88785: Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access would an attacker need to obtain a password?

How can I determine whether credentials may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access would an attacker need to obtain a password?

How can I determine whether credentials may already have been exposed?