Read the docs
TI-2026-70470 Aliases CVE-2026-88785GHSA-vv5r-wf9f-5j7m

Password disclosure in Simple Membership WordPress plugin via URL

Priority LOW 20CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The Simple Membership WordPress plugin before 4.8.3 sends a newly registered member's plaintext password in a URL query string when the optional auto-login-after-registration feature is enabled. This exposes the credential in browser history and in web server, proxy, and CDN access logs. Anyone able to read those records can obtain the password (CWE-200).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0009 0th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Simple Membership (Unknown): 4.8.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple Membershipbefore 4.8.34.8.3Patch availableCNA
  • Simple Membership VendorUnknown Affected before 4.8.3 Fixed in 4.8.3 Patch available CNA

Remediation

Update Simple Membership to version 4.8.3 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Simple Membership (Unknown) Fixed in 4.8.3

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-88785
  2. 2026-10-11 Alias added: GHSA-vv5r-wf9f-5j7m

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences