CVE-2026-88785: Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Simple Membership WordPress pluginto a version that resolves this vulnerability.Fixed in 4.8.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using a Simple Membership version earlier than 4.8.3 are exposed only when the optional auto-login-after-registration feature is enabled. The affected credentials are passwords chosen by newly registered members.
What access would an attacker need to obtain a password?
An attacker would need access to a location that records or retains the registration URL, such as the affected user's browser history or web server, proxy, or CDN access logs. The password is exposed in the URL query string during registration.
How can I determine whether credentials may already have been exposed?
Check whether auto-login after registration was enabled while running a version earlier than 4.8.3, then review browser-history exposure and web server, proxy, and CDN access logs for registration URLs containing password query-string values. Newly registered members during that period may need to change their passwords.